SQL Injection Detection Using Machine Learning with Different TF-IDF Feature Extraction Approaches

Abstract

The risk of attacks on web systems increased with the reliance of web systems in a wide range of businesses, and attackers invent new techniques to crack these systems. According to OWASP SQL injection stays one of the top 10 web applications security risks. This research use machine learning to detect SQL injection attacks, we used four machine learning models to detect SQL injection attacks. An insight into the data showing that data preparation and feature extraction have influenced the detection accuracy. The used training dataset is a combination of live requests extracted from user requests log file and a training dataset contains records of benign and malicious SQL queries. Then we compared the use of these models in term of detection quality and speed of training, results showed that Support Vector Model achieved highest detection accuracy with .997 accuracy followed by Extreme Gradient Boosting with .995 accuracy. In other hand Naïve Bayes using N-gram level feature extraction model was the fastest model it required 6 ms to train the classifier.