Аннотация
SQL and NoSQL databases are at risk from injection attacks, which is one of the most serious threats to the security of today’s data-centric systems. To address this issue, this research proposes an architecture for evaluating a new hybrid technique for detecting vulnerabilities by using a mixture of lightweight statistical machine learning techniques and a semantically verified locally installed large language model (LLM). Specifically, the proposed detection architecture consists of three major parts: (1) an initial filtering phase that uses rapid filtering through TF-IDF vectorization and logistic regression; (2) a second phase that implements a confidence-based hybrid decision logic model; and (3) a third phase using a deterministic LLM to process semantically ambiguous queries. In our experimental evaluation of a balanced benchmark of 1000 queries (500 SQL and 500 NoSQL), our proposed hybrid method achieved the highest overall performance, yielding a precision of 0.998, recall of 0.986, and F1-score of 0.992. The individual ML model obtained a lower recall of 0.964 than the standalone LLM but had F1-scores (0.981) much higher than that of standalone LLM (0.667). The hybrid architecture reduced the number of false negatives (generated by the standalone ML models) from 18 to 7 and the number of false negatives generated by the standalone LLMs from 228 to 7. The hybrid architecture achieved very few false positives. Therefore, the use of hybrid ML-LLM detection pipelines will provide both greater robustness and practical effectiveness when doing database security monitoring.