Skip to content
← All projects

Case study · Team of 2 · Technical lead (~70% of the work)

AI-Shield

A hybrid SQL-injection firewall that escalates from cheap rules to a local model to an LLM only when needed.

Problem
Rule-based SQL-injection filters miss obfuscated payloads, while sending every query to an LLM is slow and expensive.
Approach
  1. Layer 1: a regex whitelist passes clearly safe queries instantly.
  2. Layer 2: a Bi-LSTM classifier runs locally on the remaining queries.
  3. Layer 3: ambiguous cases go to Gemini for a second opinion.
  4. Active learning: when Gemini overrules the local model, the sample is saved and the local model is retrained, reducing false positives over time.
Stack
Spring BootFastAPITensorFlow (Bi-LSTM)Gemini APIPostgreSQL
Outcome
Tested on a stratified dataset built from HTTP CSIC 2010 and a modified SQLi payload set: 98% recall, F1 0.96. On advanced bypass payloads (inline comments, hex encoding) the local model alone caught ~65%; the full hybrid pipeline caught 96%. One active-learning cycle raised the local model to ~88% on those obfuscated patterns. Trade-off: ~350 ms per request versus ~2 ms for a regex-only filter. Course project (Cyber Security, UIT, 2025–2026).
Links
Source code