一句话：提出 DeepSQLi，用深度神经语言模型学习 SQLi 攻击语义并生成测试用例，从而更高效地检测 SQL 注入漏洞。
Web 应用安全至关重要，SQL 注入（SQLi）是破坏性最强的攻击之一。自动测试 SQLi 漏洞却十分困难，因为 SQLi 变体与语义可能性数量巨大甚至无限。本文提出 DeepSQLi：采用深度神经语言模型与词序列预测，学习 SQLi 攻击中的语义知识，从而把用户输入或测试用例转换为语义相关、可能更复杂的新测试用例。作者在六个不同规模、特征与领域的真实 Web 应用上，与当前最优 SQLi 测试自动化工具 SQLmap 进行比较。结果显示，DeepSQLi 用更少测试用例发现了更多 SQLi 漏洞，同时运行速度显著更快。
Security is unarguably the most serious concern for Web applications, to which SQL injection (SQLi) attack is one of the most devastating attacks. Automatically testing SQLi vulnerabilities is of ultimate importance, yet is unfortunately far from trivial to implement. This is because the existence of a huge, or potentially infinite, number of variants and semantic possibilities of SQL leading to SQLi attacks on various Web applications. In this paper, we propose a deep natural language processing based tool, dubbed DeepSQLi, to generate test cases for detecting SQLi vulnerabilities. Through adopting deep learning based neural language model and sequence of words prediction, DeepSQLi is equipped with the ability to learn the semantic knowledge embedded in SQLi attacks, allowing it to translate user inputs (or a test case) into a new test case, which is se- mantically related and potentially more sophisticated. Experiments are conducted to compare DeepSQLi with SQLmap, a state-of-the-art SQLi testing automation tool, on six real-world Web applications that are of different scales, characteristics and domains. Empirical results demonstrate the effectiveness and the remarkable superiority of DeepSQLi over SQLmap, such that more SQLi vulnerabilities can be identified by using a less number of test cases, whilst running much faster.