Detecting SQL and NoSQL injection in HTTP request payloads using BERT-based models: A unified detection framework with continual learning

SQL injection (SQLi) and NoSQL injection (NoSQLi) remain major security threats to modern web applications. Existing studies commonly focus on a single attack type or analyze database queries rather than HTTP request payloads, while adaptation across SQLi and NoSQLi detection tasks remains underexplored. This paper proposes a unified BERT-based framework for detecting SQLi and NoSQLi directly from HTTP request payloads. Five pre-trained BERT models, representing general-purpose, cybersecurity-oriented, and code-oriented language models, are compared with conventional TF-IDF-based machine learning classifiers under three learning strategies: task-specific learning, sequential continual learning, and joint SQLi–NoSQLi training. The sequential experiments consider both SQLi-to-NoSQLi and NoSQLi-to-SQLi task orders to evaluate knowledge retention and catastrophic forgetting. Experimental results show that task-specific learning generally provides strong domain-specific detection, whereas sequential continual learning enables cross-domain learning but introduces task-order-dependent forgetting in several configurations. Joint training provides more balanced unified detection and avoids task-order dependency, although at a higher training cost. Pattern-level analysis further reveals that strong aggregate performance can coexist with weaknesses for specific injection mechanisms. Overall, the results demonstrate that no learning strategy is universally superior. Rather, task-specific, sequential, and joint learning provide different trade-offs among domain specialization, adaptation, knowledge retention, unified detection, and computational cost.