FatimatRaj/SQL_Injection_Detection

1import streamlit as st2import tensorflow as tf3from tensorflow.keras.models import load_model4from tensorflow.keras.preprocessing.text import Tokenizer5from tensorflow.keras.preprocessing.sequence import pad_sequences6import pickle7import re8import time9import numpy as np10from sklearn.ensemble import RandomForestClassifier11from sklearn.svm import SVC12 13# Load models and preprocessing components14@st.cache_resource15def load_components():16    # Load deep learning models17    cnn_model = load_model('cnn_model.h5')18    lstm_model = load_model('lstm_model.h5')19    # Load traditional ML models20    with open('rf_model.pkl', 'rb') as f:21        rf_model = pickle.load(f)22    with open('svm_model.pkl', 'rb') as f:23        svm_model = pickle.load(f)24    # Load tokenizer and vectorizer25    with open('sql_tokenizer.pkl', 'rb') as f:26        tokenizer_data = pickle.load(f)27    with open('tfidf_vectorizer.pkl', 'rb') as f:28        tfidf_vectorizer = pickle.load(f)29    return {30        'cnn_model': cnn_model,31        'lstm_model': lstm_model,32        'rf_model': rf_model,33        'svm_model': svm_model,34        'tokenizer': tokenizer_data['tokenizer'],35        'max_sequence_length': tokenizer_data['max_sequence_length'],36        'tfidf_vectorizer': tfidf_vectorizer37    }38 39# Try to load all components40try:41    components = load_components()42    model_loading_error = None43except Exception as e:44    model_loading_error = str(e)45    components = None46 47# Preprocess functions48def preprocess_query_for_deep_learning(query, tokenizer, max_sequence_length):49    sequences = tokenizer.texts_to_sequences([query])50    padded = pad_sequences(sequences, maxlen=max_sequence_length, padding='post')51    return padded52 53def preprocess_query_for_traditional_ml(query, tfidf_vectorizer):54    return tfidf_vectorizer.transform([query])55 56# Define improved regex patterns for SQL injection attempts57SQL_INJECTION_PATTERNS = [58    # SQL comment syntax that follows a quote (likely injection)59    r"(?i)'.*--",60    61    # Quote followed by OR/AND with comparison (classic injection pattern)62    r"(?i)'\s*(OR|AND)\s*['\d\w]+=\s*['\d\w]+",63    64    # SQL Comment without preceding from a query context65    r"(?i)(\s|^)--",66    67    # Multiple query execution with semicolon68    r"(?i)'.*;.*--",69    70    # UNION-based injections71    r"(?i)'\s*UNION\s+(ALL\s+)?SELECT",72    73    # Time-delay attacks74    r"(?i)'\s*;\s*WAITFOR\s+DELAY",75    76    # DROP/ALTER table attacks77    r"(?i)'\s*;\s*(DROP|ALTER)",78    79    # Quote followed by a true condition80    r"(?i)'\s*OR\s*'?\d+'?\s*=\s*'?\d+'?",81    82    # Quote followed by always true condition like 1=183    r"(?i)'\s*OR\s*(['\"]\d+['\"])=(['\"]\d+['\"])",84    85    # Batch queries86    r"(?i);\s*(SELECT|INSERT|UPDATE|DELETE|DROP)",87    88    # CAST attacks89    r"(?i)CAST\s*\(.+AS\s+.+\)",90    91    # Typical SQL function calls in injections92    r"(?i)'\s*;\s*(EXEC|EXECUTE).*",93]94 95# Safe SQL patterns that should not trigger false positives96SAFE_SQL_PATTERNS = [97    # Standard SELECT query98    r"(?i)^SELECT\s+[\w\d\s,*]+\s+FROM\s+[\w\d]+(\s+WHERE\s+[\w\d\s=<>']+)?$",99    100    # Standard INSERT query101    r"(?i)^INSERT\s+INTO\s+[\w\d]+\s*\([^)]+\)\s*VALUES\s*\([^)]+\)$",102    103    # Standard UPDATE query104    r"(?i)^UPDATE\s+[\w\d]+\s+SET\s+[\w\d\s=',]+(\s+WHERE\s+[\w\d\s=<>']+)?$",105]106 107 108# Rule-based detection function109def detect_sql_injection_with_regex(query):110    for pattern in SAFE_SQL_PATTERNS:111        if re.search(pattern, query.strip()):112            return False, None113    for pattern in SQL_INJECTION_PATTERNS:114        match = re.search(pattern, query)115        if match:116            return True, match.group(0)117    return False, None118 119# Ensemble prediction function120def predict_with_ensemble(query, components):121    # Random Forest prediction122    query_tfidf = preprocess_query_for_traditional_ml(query, components['tfidf_vectorizer'])123    rf_pred = int(components['rf_model'].predict(query_tfidf)[0])124    # SVM prediction125    svm_pred = int(components['svm_model'].predict(query_tfidf)[0])126    # CNN prediction127    query_padded = preprocess_query_for_deep_learning(query, components['tokenizer'], components['max_sequence_length'])128    cnn_probability = components['cnn_model'].predict(query_padded)[0][0]129    cnn_pred = int(cnn_probability > 0.5)130    # LSTM prediction131    lstm_probability = components['lstm_model'].predict(query_padded)[0][0]132    lstm_pred = int(lstm_probability > 0.5)133    # Count votes134    votes = [rf_pred, svm_pred, cnn_pred, lstm_pred]135    vote_count = {0: votes.count(0), 1: votes.count(1)}136    return {137        'rf': rf_pred,138        'svm': svm_pred,139        'cnn': {'prediction': cnn_pred, 'probability': float(cnn_probability)},140        'lstm': {'prediction': lstm_pred, 'probability': float(lstm_probability)},141        'vote_count': vote_count142    }143 144# Initialize session state145if 'analysis_stage' not in st.session_state:146    st.session_state.analysis_stage = 0147if 'regex_result' not in st.session_state:148    st.session_state.regex_result = None149if 'ensemble_result' not in st.session_state:150    st.session_state.ensemble_result = None151 152# App title and description153st.title("🛡️ SQL Injection Detection")154st.markdown("""155This application uses a multi-layered approach to detect potentially malicious SQL queries:1561. **Rule-based detection** using improved regex patterns.1572. **Ensemble learning** with majority voting from 4 models:158   - Random Forest159   - Support Vector Machine160   - Convolutional Neural Network161   - Long Short-Term Memory Network.162""")163 164# Display warning if models couldn't be loaded165if model_loading_error:166    st.warning(f"⚠️ Some models could not be loaded. The application will only use rule-based detection. Error: {model_loading_error}")167 168# Example queries in a dropdown169example_categories = {170    "Benign SQL Queries": [171    "SELECT * FROM users WHERE username='admin'",172    "SELECT id, name, price FROM products WHERE category_id=5",173    "SELECT COUNT(*) FROM orders WHERE date > '2023-01-01'",174    "INSERT INTO logs (user_id, action) VALUES (42, 'login')",175    "UPDATE customers SET last_login='2023-06-15' WHERE id=101",176    "DELETE FROM sessions WHERE last_activity < '2023-01-01'",177    "SELECT email FROM subscribers WHERE active=1",178    "INSERT INTO feedback (user_id, message) VALUES (87, 'Great service!')",179    "UPDATE inventory SET stock = stock - 1 WHERE product_id = 300",180    "SELECT name FROM employees WHERE department = 'Sales'",181    "SELECT AVG(rating) FROM reviews WHERE product_id = 55",182    "INSERT INTO audit_log (timestamp, event) VALUES (CURRENT_TIMESTAMP, 'update')",183    "SELECT * FROM appointments WHERE doctor_id = 10 AND status = 'confirmed'",184    "UPDATE settings SET value='dark' WHERE key='theme'",185    "SELECT DISTINCT city FROM customers WHERE country='USA'",186    "DELETE FROM cart_items WHERE user_id=12 AND product_id=78",187    "SELECT MAX(salary) FROM employees WHERE role='manager'",188    "INSERT INTO payments (user_id, amount, method) VALUES (33, 99.99, 'credit')",189    "UPDATE products SET price = price * 1.1 WHERE category_id = 7",190    "SELECT * FROM messages WHERE sender_id = 5 AND is_read = 0"191    ],192    "Malicious SQL Queries": [193    "' OR 1=1 --",194    "admin'; DROP TABLE users; --",195    "SELECT * FROM users WHERE username='' UNION SELECT username,password FROM admin_users --",196    "'; WAITFOR DELAY '0:0:10' --",197    "admin' OR '1'='1",198    "' OR 'a'='a",199    "' OR 1=1#",200    "' OR 1=1/*",201    "admin'--",202    "'; EXEC xp_cmdshell('dir'); --",203    "' OR EXISTS(SELECT * FROM users WHERE username = 'admin') --",204    "1; DROP TABLE sessions --",205    "'; SHUTDOWN --",206    "' OR SLEEP(5) --",207    "' AND 1=(SELECT COUNT(*) FROM users) --",208    "admin' AND SUBSTRING(password, 1, 1) = 'a' --",209    "' UNION ALL SELECT NULL,NULL,NULL --",210    "0' OR 1=1 ORDER BY 1 --",211    "1' AND (SELECT COUNT(*) FROM users) > 0 --",212    "' OR (SELECT ASCII(SUBSTRING(password,1,1)) FROM users WHERE username='admin') > 64 --"213    ]214}215 216 217category = st.selectbox("Choose query category:", options=list(example_categories.keys()))218example = st.selectbox("Select an example:", options=example_categories[category])219query_source = st.radio("Query source:", ["Use selected example", "Enter my own query"])220query = example if query_source == "Use selected example" else st.text_area("Enter SQL Query:", placeholder="Type your SQL query here...")221 222 223# Analysis process224if st.button("Start Analysis") and query:225    st.session_state.analysis_stage = 1226    with st.spinner("Running rule-based detection..."):227        time.sleep(0.5)  # Simulate processing time228        is_malicious, matched_pattern = detect_sql_injection_with_regex(query)229        st.session_state.regex_result = (is_malicious, matched_pattern)230 231# Rule-based analysis results232if st.session_state.analysis_stage >= 1 and st.session_state.regex_result is not None:233    is_malicious, matched_pattern = st.session_state.regex_result234    st.subheader("Step 1: Rule-Based Detection")235    236    if is_malicious:237        st.error("🚨 SQL Injection Detected (Rule-Based)!")238        st.warning(f"Matched pattern: `{matched_pattern}`")239    else:240        st.success("✅ No SQL injection patterns detected using rules")241    242    # Always offer to proceed with ensemble detection regardless of rule-based result243    proceed = st.radio("Proceed with ensemble detection?", ["Yes", "No"], index=0)244    245    if proceed == "Yes":246        # Check if models are available before proceeding247        if model_loading_error:248            st.error("⚠️ Cannot proceed: Models failed to load. Please check logs.")249        else:250            if st.button("Run Ensemble Analysis"):251                st.session_state.analysis_stage = 2252                with st.spinner("Running ensemble models..."):253                    time.sleep(1)  # Simulate processing time254                    ensemble_results = predict_with_ensemble(query, components)255                    st.session_state.ensemble_result = ensemble_results256 257# Ensemble analysis results258if st.session_state.analysis_stage >= 2 and st.session_state.ensemble_result is not None:259    results = st.session_state.ensemble_result260    st.subheader("Step 2: Ensemble Model Detection")261    262    vote_benign = results['vote_count'][0]263    vote_malicious = results['vote_count'][1]264    265    # Create columns for voting visualization266    col1, col2 = st.columns(2)267    with col1:268        st.metric("Safe Votes", vote_benign)269    with col2:270        st.metric("Malicious Votes", vote_malicious)271    272    # Progress bar for malicious ratio273    vote_ratio = vote_malicious / (vote_benign + vote_malicious)274    st.progress(vote_ratio, text=f"Malicious vote ratio: {vote_ratio*100:.0f}%")275    276    # Display individual model results277    st.markdown("### Individual Model Results")278    model_cols = st.columns(4)279    280    with model_cols[0]:281        st.markdown("**Random Forest**")282        if results['rf'] == 1:283            st.error("⚠️ Malicious")284        else:285            st.success("✅ Safe")286    287    with model_cols[1]:288        st.markdown("**SVM**")289        if results['svm'] == 1:290            st.error("⚠️ Malicious")291        else:292            st.success("✅ Safe")293    294    with model_cols[2]:295        st.markdown("**CNN**")296        cnn_prob = results['cnn']['probability'] * 100297        if results['cnn']['prediction'] == 1:298            st.error(f"⚠️ Malicious ({cnn_prob:.1f}%)")299        else:300            st.success(f"✅ Safe ({100-cnn_prob:.1f}%)")301    302    with model_cols[3]:303        st.markdown("**LSTM**")304        lstm_prob = results['lstm']['probability'] * 100305        if results['lstm']['prediction'] == 1:306            st.error(f"⚠️ Malicious ({lstm_prob:.1f}%)")307        else:308            st.success(f"✅ Safe ({100-lstm_prob:.1f}%)")309    310    # Ensemble verdict based on vote counts311    st.markdown("### Ensemble Verdict")312    313    # Use regex as tiebreaker when ensemble votes are equal314    is_malicious_regex, _ = st.session_state.regex_result315    316    if vote_malicious > vote_benign:317        st.error(f"🚨 SQL Injection Detected by Majority Vote ({vote_malicious}/{vote_benign + vote_malicious} malicious votes)")318        ensemble_verdict = "malicious"319    elif vote_benign > vote_malicious:320        st.success(f"✅ Query deemed safe by majority vote ({vote_benign}/{vote_benign + vote_malicious} safe votes)")321        ensemble_verdict = "benign"322    else:  # It's a tie323        # Use regex result as tiebreaker324        if is_malicious_regex:325            st.error("🚨 SQL Injection Detected (Ensemble tie broken by rule-based detection)")326            ensemble_verdict = "malicious"327        else:328            st.success("✅ Query deemed safe (Ensemble tie broken by rule-based detection)")329            ensemble_verdict = "benign"330 331    # Final verdict combining both approaches332    st.subheader("Final Analysis")333    is_malicious_ensemble = ensemble_verdict == "malicious"334    335    if is_malicious_regex and is_malicious_ensemble:336        st.error("⚠️ HIGH RISK: Both rule-based and ensemble models detected malicious patterns!")337    elif is_malicious_regex:338        st.error("⚠️ ELEVATED RISK: Rule-based detection found malicious patterns.")339    elif is_malicious_ensemble:340        st.error("⚠️ ELEVATED RISK: Ensemble models detected malicious patterns.")341    else:342        st.success("✅ LOW RISK: Query passed both rule-based and ensemble model checks.")343 344# Reset button to analyze another query345if st.session_state.analysis_stage >= 1:346    if st.button("Analyze Another Query"):347        st.session_state.analysis_stage = 0348        st.session_state.regex_result = None349        st.session_state.ensemble_result = None350        st.rerun()351 352# Sidebar with additional info353with st.sidebar:354    st.header("About This App")355    st.markdown("""356    ### Multi-Layer Detection Process357    358    1. **Rule-Based Detection**359       - Fast, pattern-matching approach360       - Uses improved regex to identify SQL injection patterns361       - Reduces false positives with safe pattern recognition362    363    2. **Ensemble Detection**364       - Combines 4 different machine learning models:365         - Random Forest366         - Support Vector Machine (SVM)367         - Convolutional Neural Network (CNN)368         - Long Short-Term Memory Network (LSTM)369       - Final decision by majority voting370    """)371    372    st.markdown("### Machine Learning Architecture")373    st.code("""374    # Traditional ML375    - Random Forest (n_estimators=100)376    - SVM (kernel='linear')377    378    # CNN Architecture379    Sequential([380        Embedding(input_dim=10000, output_dim=128),381        Conv1D(filters=64, kernel_size=3, activation='relu'),382        MaxPooling1D(pool_size=2),383        Dropout(0.5),384        Conv1D(filters=128, kernel_size=3, activation='relu'),385        MaxPooling1D(pool_size=2),386        Flatten(),387        Dense(64, activation='relu'),388        Dropout(0.5),389        Dense(1, activation='sigmoid')390    ])391    392    # LSTM Architecture393    Sequential([394        Embedding(input_dim=10000, output_dim=128),395        Bidirectional(LSTM(64, return_sequences=True)),396        Dropout(0.5),397        Bidirectional(LSTM(32)),398        Dropout(0.5),399        Dense(32, activation='relu'),400        Dense(1, activation='sigmoid')401    ])402    """)403    404    st.markdown("### How It Works")405    st.markdown("""406    1. **Step 1:** Rule-based patterns scan for known SQL injection techniques407    2. **Step 2:** Ensemble of 4 models evaluates the query structure408    3. **Final Analysis:** Combined verdict from both approaches409    """)410    411    st.markdown("---")412    st.warning("**Note:** This is a demonstration tool, not a replacement for proper security measures.")413 414# Footer415st.markdown("---")416st.markdown("""417<style>418.footer {419    position: fixed;420    left: 0;421    bottom: 0;422    width: 100%;423    background-color: white;424    color: black;425    text-align: center;426    padding: 10px;427    border-top: 1px solid #e5e5e5;428}429</style>430<div class="footer">431<p>Developed with ❤️ using Streamlit | SQL Injection Detection System</p>432</div>433""", unsafe_allow_html=True)