Superviz25-SQL: SQL Injection Detection Dataset

Dataset Description Superviz25-SQL is an SQL Injection Detection Dataset made to evaluate unsupervised SQL Injection detection techniques. The dataset allows to compare the capability of mechanisms trained on the benign workload of a specific database deployment to detect SQL Injection attack targeting this deployment. We provide a test and train split, the train set consists of 335306 benign queries. The test set comprise 3017390 normal samples and 336281 malicious samples (90:10). Some queries typical of insider attacks are also contained in the dataset (n=1089). The dataset offers more than the SQL query and its label as extended metadata is provided to facilitate the comparison of detection approaches. For instance the attack technique information allows to compare the effectiveness of detection mechanism across existing SQL Injection techniques. Furthermore, the user input field allows the comparison of approaches basing their detection on full queries to those solely using the user inputs. The code used for the generation of this dataset is available at gquetel/sqlia-dataset. If you use this dataset, please acknowledge it by citing the original paper: Grégor Quetel, Eric Alata, Pierre-François Gimenez, Thomas Robert, Laurent Pautet. Superviz25-SQL: high-quality dataset to empower unsupervised SQL injection detection systems. 1st International Workshop on Assessment with New methodologies, Unified Benchmarks, and environments, of Intrusion detection and response Systems (ANUBIS), Sep 2025, Toulouse, France. ⟨hal-05314211⟩ This work has been partially supported by the French National Research Agency under the France 2030 label (Superviz ANR-22-PECY-0008). The views reflected herein do not necessarily reflect the opinion of the French government. Usage The proposed training and testing sets can easily be loaded using python and pandas as follows: import pandas as pd df = pd.read_csv( "dataset.csv", dtype={ "full_query": str, "label": int, "user_inputs": str, "attack_stage": str, "tamper_method": str, "attack_status": str, "statement_type": str, "query_template_id": str, "attack_id": str, "attack_technique": str, "split": str, }, ) df_train = df[df["split"] == "train"] df_test = df[df["split"] == "test"]