SQL injection remains a major threat to web applications, as existing defenses often fail against obfuscation and evolving attacks because of neglecting the request-response context. This paper presents a context-enriched SQL injection detection framework, focusing on constructing a high-quality request-response dataset via a multi-agent honeypot system: the Request Generator Agent produces diverse malicious/benign requests, the Database Response Agent mediates interactions to ensure authentic responses while protecting production data, and the Traffic Monitor pairs requests with responses, assigns labels, and cleans data, yielding totally 140,973 labeled pairs with contextual cues absent in payload-only data. Experiments show that models trained on this context dataset outperform payload-only counterparts: CNN and BiLSTM achieve over 40\% accuracy improvement in different tasks, validating that the request-response context enhances the detection of evolving and obfuscated attacks.

翻译：SQL注入仍然是Web应用程序面临的主要威胁，由于现有防御机制常忽略请求-响应上下文，难以应对混淆技术和持续演变的攻击。本文提出一种上下文增强的SQL注入检测框架，重点通过多智能体蜜罐系统构建高质量的请求-响应数据集：请求生成智能体产生多样化的恶意/良性请求，数据库响应智能体通过中介交互确保真实响应同时保护生产数据，流量监控智能体将请求与响应配对、分配标签并进行数据清洗，最终生成包含140,973个带标签的请求-响应对，其中蕴含纯载荷数据所缺失的上下文线索。实验表明，基于此上下文数据集训练的模型性能显著优于纯载荷模型：CNN与BiLSTM在不同任务中均实现超过40%的准确率提升，验证了请求-响应上下文对增强演变型与混淆型攻击检测的有效性。