Authors

Nwile, Beauty Nuka

Department of Computer Science, Rivers State University, Port Harcourt, Nigeria

Daniel Matthias

Professor, Department of Computer Science, Rivers State University, Port Harcourt, Nigeria

Vincent I. E. Anireh

Professor, Department of Computer Science, Rivers State University, Port Harcourt, Nigeria

Onate E. Taylor

Associate Professor, Department of Computer Science, Rivers State University, Port Harcourt, Nigeria

Abstract

This study presents the design and evaluation of an improved input validation architecture for Graph Query Language (GraphQL), addressing key issues in performance, security, and scalability within GraphQL environments. With the increasing adoption of GraphQL in API-driven systems, effective input validation is critical to mitigate security vulnerabilities, optimize query efficiency, and enhance system robustness. Traditional input validation approaches, primarily built for Standard Graphql API frameworks, often fail to address the unique needs and complexities inherent in GraphQL-based systems. This study was conducted to bridge this gap by developing a tailored input validation framework aimed at improving request parsing, query complexity handling, and resource utilization. The methodology utilized in this study is constructive research methodology combined with an object oriented and design methodology, this involved a comparative analysis of the newly developed framework against existing standard Graphql API input validation methods, focusing on metrics such as error rate, request parsing time, data integrity, bandwidth consumption, query complexity management, throughput, latency, and time to first byte (TTFB). Results demonstrated that the optimized GraphQL framework achieved a 40% reduction in error rate and bandwidth consumption, a 50% decrease in request parsing time, and a 30% improvement in throughput, thus validating the effectiveness of the proposed model. This performance was achieved without compromising data integrity, ensuring that only valid and necessary data is processed, thereby reducing payload size and minimizing network strain. In alignment with the study's objectives, this research provides significant contributions to knowledge in the domain of GraphQL optimization by offering an adaptable and efficient input validation architecture capable of handling high-complexity queries while securing the system against injection attacks and data inconsistencies. The findings indicate that the proposed model not only strengthens system security but also enhances scalability and response times, proving its applicability to high-traffic environments. This research sets a foundation for future studies aimed at refining input validation strategies within evolving API technologies.

Keywords

GraphQL Optimization Dynamic Input Validation Query Complexity Analysis API Security Framework Context-Aware Sanitization.

Citation of this Article

Nwile, Beauty Nuka, Daniel Matthias, Vincent I. E. Anireh, & Onate E. Taylor. (2026). Model for Dynamic Input Validation for Graph Query Language (GraphQL). Journal of Artificial Intelligence and Emerging Technologies (JAIET). 3(7), 45-60. Article DOI: https://doi.org/10.47001/JAIET/2026.307005

Licence Copyright (c) 2026 Journal of Artificial Intelligence and Emerging Technologies. This work is licensed under a Creative Commons Attribution Non Commercial 4.0 International Licence.

References

Adamos, K., Stergiopoulos, G., Karamousadakis, M., &Gritzalis, D. (2024). Enhancing attack resilience of cyber-physical systems through state dependency graph models. International Journal of Information Security, 23(1). https://doi.org/10.1007/s10207-023-00731-w

Agbefu, R. E., Hori, Y., & Sakurai, K. (2013). Domain Information Based Blacklisting Method For The Detection Of Malicious Webpages. International Journal of Cyber-Security and Digital Forensics (IJCSDF), 2(2).

Ali, S. A., & Zafar, M. W. (2021). API gateway architecture explained. International Journal of Computer Science and Technology, 5(1).

Alkhalaf, M., Bultan, T., & Gallegos, J. L. (2012). Verifying client-side input validation functions using string analysis. Proceedings - International Conference on Software Engineering. https://doi.org/10.1109/ICSE.2012.6227124

Alkhalaf, M., Choudhary, S. R., Fazzini, M., Bultan, T., Orso, A., & Kruegel, C. (2012). ViewPoints: Differential string analysis for discovering client- and server-side input validation inconsistencies. 2012 International Symposium on Software Testing and Analysis, ISSTA 2012 –Proceedings. https://doi.org/10.1145/04000800.2336760

Alzamzami, M. N., & Azizah, F. N. (2022). GraphQL-based Backend Service Development Tool for CRUD Operations, Authentication and Authorization. Proceedings of 2022 International Conference on Data and Software Engineering, ICoDSE 2022. https://doi.org/10.1109/ICoDSE56892.2022.9971818.

Antonio, Q. M. & Pablo, F. (2023).  A System mapping study. ACM computing survey, 55(10).

Anugrah, I. G., & Fakhruddin, M. A. R. I. (2020). Development Authentication and Authorization Systems of Multi Information Systems Based REst API and Auth Token. Innovation Research Journal, 1(2). https://doi.org/10.30587/innovation.v1i2.1927

Atlidakis, V., Godefroid, P., & Polishchuk, M. (2020). Checking Security Properties of Cloud Service REST APIs. Proceedings - 2020 IEEE 13th International Conference on Software Testing, Verification and Validation, ICST 2020. https://doi.org/10.1109/ICST46399.2020.00046

Azizul, N. H., Zin, A. M., Muniyandi, R. C., & Shukur, Z. (2019). Authentication and authorization design in Honeybee computing. International Journal of Advanced Computer Science and Applications, 10(9). https://doi.org/10.14569/ijacsa.2019.0100903

Balzarotti, D., Cova, M., Felmetsger, V., Jovanovic, N., Kirda, E., Kruegel, C., & Vigna, G. (2008). Saner: Composing static and dynamic analysis to validate sanitization in web applications. Proceedings - IEEE Symposium on Security and Privacy. https://doi.org/10.1109/SP.2008.22

Baset, A. Z., & Denning, T. (2017). IDE plugins for detecting input-validation vulnerabilities. Proceedings - 2017 IEEE Symposium on Security and Privacy Workshops, SPW 2017, 2017-December. https://doi.org/10.1109/SPW.2017.37

Belhadi, A., Zhang, M., & Arcuri, A. (2022). Evolutionary-based automated testing for GraphQL APIs. GECCO 2022 Companion - Proceedings of the 2022 Genetic and Evolutionary Computation Conference. https://doi.org/10.1145/3520304.3528952

Belhadi, A., Zhang, M., & Arcuri, A. (2024). Random Testing and Evolutionary Testing for Fuzzing GraphQL APIs. ACM Transactions on the Web, 18(1). https://doi.org/10.1145/3609427

Beuhring, A., &Salous, K. (2014). Beyond blacklisting: Cyberdefense in the era of advanced persistent threats. IEEE Security and Privacy, 12(5). https://doi.org/10.1109/MSP.2014.86

Cortier, V., & Steel, G. (2014). A generic security API for symmetric key management on cryptographic devices. Information and Computation, 238. https://doi.org/10.1016/j.ic.2014.07.010

De, B. (2017). API Management: An Architect´s Guide to Developing and Managing APIs for Your Organization. In API Management: Vol. First Edit.

De, B. (2023). API Governance. In API Management. https://doi.org/10.1007/979-8-8688-0054-2_12

Diego Casagranda França, M., & Da Silva, E. (2020). Performance Evaluation of REST and GraphQL APIs Searching Nested Objects. https://doi.org/10.14210/cotb.v11n1.p237-244

Doolittle, J. (2023). APIs With GraphQL. In IEEE Software (Vol. 40, Issue 2). https://doi.org/10.1109/MS.2022.3227254

Faisal, F., &Elshoush, H. T. (2023). Input Validation Vulnerabilities in Web Applications: Systematic Review, Classification and Analysis of the Current State-of-the-Art. IEEE Access. https://doi.org/10.1109/ACCESS.2023.3266385

Frisendal, T. (2018). GraphQL Concepts. In Visual Design of GraphQL Data. https://doi.org/10.1007/978-1-4842-3904-9_2

Godefroid, P., Lehmann, D., & Polishchuk, M. (2020). Differential regression testing for REST APIs. ISSTA 2020 - Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis. https://doi.org/10.1145/3395363.3397374

Green, S., de Marneffe, M. C., & Manning, C. D. (2013). Parsing models for identifying multiword expressions. Computational Linguistics, 39(1). https://doi.org/10.1162/COLI_a_00139

Guo, Y., Deng, F., & Yang, X. (2018). Design and Implementation of Real-Time Management System Architecture based on GraphQL. IOP Conference Series: Materials Science and Engineering, 466(1). https://doi.org/10.1088/1757-899X/466/1/012015

Hajrić, A., Smaka, T., Baraković, S., & Husić, J. B. (2020). Methods, Methodologies and Tools for Threat Modeling with Case Study. Telfor Journal, 12(1). https://doi.org/10.5937/TELFOR2001056H

Helfer, J. (2016). A guide to authentication in GraphQL. Apollo Dev Blog.

Ivanova, N. D., & Ivanenko, V. G. (2023). Modeling advanced persistent threats using risk matrix methods. Journal of Computer Virology and Hacking Techniques, 19(3). https://doi.org/10.1007/s11416-022-00440-3

Jbair, M., Ahmad, B., Maple, C., & Harrison, R. (2022). Threat modelling for industrial cyber physical systems in the era of smart manufacturing. Computers in Industry, 137. https://doi.org/10.1016/j.compind.2022.103611

Jiménez-López, M. D. (2011). Agents in formal language theory: An overview. In Advances in Intelligent and Soft Computing (Vol. 89). https://doi.org/10.1007/978-3-642-19917-2_34

Kim, M., Xin, Q., Sinha, S., & Orso, A. (2022). Automated test generation for REST APIs: No time to rest yet. ISSTA 2022 - Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis. https://doi.org/10.1145/3533767.3534401

Kornienko, D. V., Mishina, S. V., Shcherbatykh, S. V., & Melnikov, M. O. (2021). Principles of securing RESTful API web services developed with python frameworks. Journal of Physics: Conference Series, 2094(3). https://doi.org/10.1088/1742-6596/2094/3/032016

Landeiro, M. I., & Azevedo, I. (2020). AnalyzingGraphQL performance: A case study. In Software Engineering for Agile Application Development. https://doi.org/10.4018/978-1-7998-2531-9.ch005

Loukas, G. (2015). Protection Mechanisms and Secure Design Principles. In Cyber-Physical Attacks. https://doi.org/10.1016/b978-0-12-801290-1.00006-0

Martín-Vide, C. (2012). Formal Grammars and Languages. In The Oxford Handbook of Computational Linguistics, (9780199276349). https://doi.org/10.1093/oxfordhb/9780199276349.013.0008

Massé, M. (2013). REST API Design Rulebook. In Journal of Chemical Information and Modeling, 53(9).

Mowla, S., & Kolekar, S. V. (2020). Development and integration of E-learning services using rest APIs. International Journal of Emerging Technologies in Learning, 15(4). https://doi.org/10.3991/ijet.v15i04.11687

Mukhiya, S. K., & Lamo, Y. (2021). An HL7 FHIR and GraphQL approach for interoperability between heterogeneous Electronic Health Record systems. Health Informatics Journal, 27(3). https://doi.org/10.1177/14604582211043920

Nithya, V., & Senthilkumar, S. (2019). Detection and avoidance of input validation attacks in web application using deterministic push down automata., 51(9). https://doi.org/10.1615/JAutomatInfScien.v51.i9.40

Ogboada, J. G., Anireh, V. I. E., & Matthias, D. (2021). A model for optimizing the runtime of GraphQL queries. International Journal of Innovative Information Systems & Technology Research, 9(3), 11–39.

Palma, F., Olsson, T., Wingkvist, A., & Gonzalez-Huerta, J. (2022). Assessing the linguistic quality of REST APIs for IoT applications. Journal of Systems and Software, 191. https://doi.org/10.1016/j.jss.2022.111369

Pareek, H. (2012). Application Whitelisting: Approaches and Challenges. International Journal of Computer Science, Engineering and Information Technology, 2(5). https://doi.org/10.5121/ijcseit.2012.2502

Pasquini, M., Serva, M., &Vergni, D. (2023). Gradual Modifications and Abrupt Replacements: Two Stochastic Lexical Ingredients of Language Evolution. Computational Linguistics, 49(2). https://doi.org/10.1162/coli_a_00471

Patnaik, N., Dwyer, A., Hallett, J., & Rashid, A. (2023). SLR: From Saltzer and Schroeder to 2021...47 Years of Research on the Development and Validation of Security API Recommendations. ACM Transactions on Software Engineering and Methodology, 32(3). https://doi.org/10.1145/3561383

Preibisch, S. (2018). API Authentication and Authorization. In API Development (pp. 61–105). Apress. https://doi.org/10.1007/978-1-4842-4140-0_5

Putra, M. A. R., Ahmad, T., Hostiadi, D. P., Ijtihadie, R. M., &Maniriho, P. (2024). Botnet Attack Analysis through Graph Visualization. International Journal of Intelligent Engineering and Systems, 17(1). https://doi.org/10.22266/ijies2024.0229.75

Quiña-Mera, A., Fernandez, P., García, J. M., & Ruiz-Cortés, A. (2023). GraphQL: A Systematic Mapping Study. ACM Computing Surveys, 55(10). https://doi.org/10.1145/3561818

Ramadhan, R., & Syahidin, Y. (2022). The Implementation of REST API in Multi-Platform Software Development for Food and Beverage Learning Application. Jurnal E-Komtek (Elektro-Komputer-Teknik), 6(1). https://doi.org/10.37339/e-komtek.v6i1.814

Ramlakshmi, T. B. (2013). Language learning theories: An overview. Shanlax International Journal of Education, 2(1).

Sajini, G., &Kallimani, J. S. (2019). Research on cache transition techniques for semantic graph parsing for optimizing search process using text mining. International Journal of Recent Technology and Engineering, 8(2 Special Issue 8). https://doi.org/10.35940/ijrte.B1040.0882S819

Salecha, R. (2023). Authentication and Authorization. In Practical GitOps. https://doi.org/10.1007/978-1-4842-8673-9_8

Saxena, P., Hanna, S., Poosankam, P., & Song, D. (2010). FLAX: Systematic Discovery of Client-side Validation Vulnerabilities in Rich Web Applications. Proceedings of the Symposium on Network and Distributed System Security, NDSS 2010.

Scholte, T., Robertson, W., Balzarotti, D., &Kirda, E. (2012). Preventing input validation vulnerabilities inweb applications through automated type analysis. Proceedings - International Computer Software and Applications Conference. https://doi.org/10.1109/COMPSAC.2012.34

Selin, J. (2019). Evaluation of Threat Modeling Methodologies A Case Study. School of Technology Information and Communication Technology, May.

Shar, L. K., & Tan, H. B. K. (2012). Predicting common web application vulnerabilities from input validation and sanitization code patterns. 2012 27th IEEE/ACM International Conference on Automated Software Engineering, ASE 2012 - Proceedings. https://doi.org/10.1145/2351676.2351733

Simplilearn. (2020). What is Threat Modeling: Process and Methodologies. In Simplilearn Solutions.

Spasev, V., Dimitrovski, I., & Kitanovski, I. (2020). An Overview of GraphQL: Core Features and Architecture. ICT Innovations Conference 2020, 24-Sep-2020.

Stubailo, S. (2017). GraphQL vs. REST – Apollo GraphQL. Blog.Apollographql.Com.

Sturgeon, P. (2017). GraphQL vs REST: Overview. Phil Sturgeon Blog.

Tecumseh Fitch, W., &Friederici, A. D. (2012). Artificial grammar learning meets formal language theory: An overview. In Philosophical Transactions of the Royal Society B: Biological Sciences, 367(1598). https://doi.org/10.1098/rstb.2012.0103

Vohra, N., &KerthyayanaManuaba, I. B. (2022). Implementation of REST API vs GraphQL in Microservice Architecture. Proceedings of 2022 International Conference on Information Management and Technology, ICIMTech 2022. https://doi.org/10.1109/ICIMTech55957.2022.9915098

Votipka, D., Fulton, K. R., Parker, J., Hou, M., Mazurek, M. L., & Hicks, M. (2020). Understanding security mistakes developers make: Qualitative analysis from build it, break it, fix it. Proceedings of the 29th USENIX Security Symposium.

Wang, L., Ma, X., Li, N., Lv, Q., Wang, Y., Huang, W., & Chen, H. (2023). TGPrint: Attack fingerprint classification on encrypted network traffic-based graph convolution attention networks. Computers and Security, 135. https://doi.org/10.1016/j.cose.2023.103466

Wang, P., Bangert, J., & Kern, C. (2021). If it’s not secure, it should not compile: Preventing DOM-Based XSS in large-scale web development with API hardening. Proceedings - International Conference on Software Engineering. https://doi.org/10.1109/ICSE43902.2021.00123

Weissbacher, M., Robertson, W., Kirda, E., Kruegel, C., & Vigna, G. (2015). Zigzag: Automatically hardening web applications against client-side validation vulnerabilities. Proceedings of the 24th USENIX Security Symposium.

Wittern, E., Cha, A., Davis, J. C., Baudart, G., & Mandel, L. (2019). An Empirical Study of GraphQL Schemas. Lecture Notes in Computer Science (Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 11895 LNCS. https://doi.org/10.1007/978-3-030-33702-5_1

Wuyts, K., Scandariato, R., & Joosen, W. (2014). Empirical evaluation of a privacy-focused threat modeling methodology. Journal of Systems and Software, 96. https://doi.org/10.1016/j.jss.2014.05.075.