Utilizing Large Language Model Algorithm for XSS, SQL, and Command Injection Detection

Imagine the internet as a bustling, chaotic city where websites are the shops, banks, and town halls. Just like in any city, there are troublemakers trying to sneak in through the front door, pick the locks, or shout fake orders to the staff. In the world of computer security, these troublemakers use "injection attacks." It's a fancy name for a simple trick: instead of giving a website a normal request, a hacker types in a secret command hidden inside a text box, hoping the website will accidentally obey it. It's like a customer walking into a bakery and whispering, "Actually, I'd like you to delete your entire inventory," and the baker, confused, actually doing it.

To catch these sneaky troublemakers, security experts have built digital bouncers. For years, these bouncers were like strict librarians who only let in books that looked exactly like the ones on their approved list. If a book had a weird cover or a strange title, it got rejected. But hackers are getting smarter; they change their "covers" and "titles" so fast that the old bouncers can't keep up. Enter the new generation of bouncers: Large Language Models (LLMs). Think of these not as rigid librarians, but as super-smart detectives who have read almost every book in the library. They don't just look at the cover; they understand the story, the tone, and the hidden meaning. They can tell the difference between a harmless sentence and a malicious command just by "feeling" the text. This paper asks a big question: Can these super-smart detectives be trained to spot the specific tricks hackers use to break into websites, and do they need to be giant, energy-hungry monsters to do the job, or can a smaller, quicker detective work just as well?

The researchers behind this study decided to put four different AI detectives through a massive training camp to see which one could best spot three specific types of digital break-ins: Cross-Site Scripting (XSS), SQL Injection, and Command Injection. They didn't just guess; they fed these models a huge dataset of over 180,000 examples of both "good" traffic and "bad" traffic, including tricky, disguised attacks. They then fine-tuned the models, which is like giving them a specialized textbook on hacker tricks so they could learn the specific patterns of these crimes.

The results were surprisingly close, almost like a race where the winners crossed the finish line within a hair's breadth of each other. The star of the show was a model called LLaMA-3.2-1B. It performed the best overall, correctly identifying malicious traffic with 99.80% accuracy, 99.82% precision, and a 99.81% F1-score. It was incredibly sharp, missing very few bad guys and rarely accusing innocent people. However, the paper also found that you don't necessarily need the biggest detective to get the job done. A much smaller model called DistilBERT-base-uncased, which has only about 0.93% of the trainable parameters of its larger cousins (roughly 630,532 trainable parameters out of 67.6 million total), achieved nearly identical results: 99.80% across the board for accuracy, precision, recall, and F1-score.

The study also tested two other models, GPT-2 and GPT-2-medium. They performed very well too, with accuracy and precision hovering around 99.7% to 99.8%. Interestingly, the researchers found that making the model bigger didn't always make it better. The GPT-2-medium model, which is roughly three times larger than the standard GPT-2, didn't actually catch more bad guys; in fact, it scored slightly lower. This suggests that for this specific task, once a model is big enough to understand the patterns, making it even bigger is like buying a super-expensive sports car just to drive to the grocery store—it doesn't get you there any faster.

When looking at how the models made mistakes, the paper revealed some interesting quirks. All four models were almost perfect at spotting XSS attacks; in fact, three of them got 100% of the XSS test cases right. It seems the "script" tags used in these attacks are like a giant neon sign that is impossible to miss. However, Command Injection was the trickiest category. The LLaMA model struggled a bit more here, occasionally mistaking a command injection for normal traffic. Meanwhile, the GPT-2 models tended to be a bit too paranoid, flagging normal, safe traffic as an attack more often than the others.

The authors conclude that while the giant LLaMA-3.2-1B model showed the strongest overall performance, the tiny DistilBERT model is a fantastic alternative for real-world use because it is so much faster and requires less computing power while delivering almost the same level of protection. The paper suggests that fine-tuning these models is a powerful way to catch injection attacks, but it also notes that this is just the beginning. The researchers point out that they faced challenges, such as a lack of previous studies on this specific topic and limited computing resources, which means there is still a lot of work to be done to perfect these digital bouncers. Ultimately, the study proves that with the right training, even a small, efficient AI can become a nearly perfect guardian against some of the most common web threats.