Research on Vulnerability Detection Methods in SQL and NoSQL Systems Using Machine Learning and Large Language Models

Yasfirbek Rozmetov, Anel Aidos, Murat Ozer, Alibek Bissembayev, Aigul Bissarinova, Assel Mukasheva

2026

Full text Open access: Gold Metadata (CSL-JSON)
DOI 10.3390/engproc2026154089
Data confidence 70 medium
How this score is calculated

It is built from checkable properties of the record itself: whether the article has a DOI, how many independent sources confirmed its data, whether the required fields are filled in, and how recent the latest confirmation is. Disagreement between sources and a missing identifier lower it. A value of 80 or above means the record was published without further checking; 60 to 79 means it is published at reduced confidence, with a manual check advisable. A record verified by an editor by hand is never pushed below 90 by a recalculation. This scores our data about the article, not the article itself.

Abstract

SQL and NoSQL databases are at risk from injection attacks, which is one of the most serious threats to the security of today’s data-centric systems. To address this issue, this research proposes an architecture for evaluating a new hybrid technique for detecting vulnerabilities by using a mixture of lightweight statistical machine learning techniques and a semantically verified locally installed large language model (LLM). Specifically, the proposed detection architecture consists of three major parts: (1) an initial filtering phase that uses rapid filtering through TF-IDF vectorization and logistic regression; (2) a second phase that implements a confidence-based hybrid decision logic model; and (3) a third phase using a deterministic LLM to process semantically ambiguous queries. In our experimental evaluation of a balanced benchmark of 1000 queries (500 SQL and 500 NoSQL), our proposed hybrid method achieved the highest overall performance, yielding a precision of 0.998, recall of 0.986, and F1-score of 0.992. The individual ML model obtained a lower recall of 0.964 than the standalone LLM but had F1-scores (0.981) much higher than that of standalone LLM (0.667). The hybrid architecture reduced the number of false negatives (generated by the standalone ML models) from 18 to 7 and the number of false negatives generated by the standalone LLMs from 228 to 7. The hybrid architecture achieved very few false positives. Therefore, the use of hybrid ML-LLM detection pipelines will provide both greater robustness and practical effectiveness when doing database security monitoring.