Machine learning offers fresh approach to tackling SQL injection vulnerabilities

UPDATED A new machine learning technique could make it easier for penetration testers to find SQL injection exploits in web applications. Introduced in a recently published paper by researchers at the University of Oslo, the method uses reinforcement learning to automate the process of exploiting a known SQL injection vulnerability. While the technique comes with quite a few caveats and assumptions, it provides a promising path toward developing machine learning models that can assist in penetration testing and security assessment tasks. Reinforcement learning is a branch of machine learning in which an AI model is given the possible actions and rewards of an environment and is left to find the best ways to apply those actions to maximize the reward. "It's inevitable that AI and machine learning are also applied in offensive security," Laszlo Erdodi, lead author of the paper and postdoctoral fellow at the department of informatics at the University of Oslo, told The Daily Swig.