Detection and Mitigation of SQL Injection-based Attacks in Web Security

Abstract

Crafty tactics like nested request bodies, encoding schemes, and JavaScript Object Notation (JSON) operators are now used by attackers to trick and bypass conventional Web application firewalls. The proposed machine learning-based system for detecting and mitigating SQL injection attacks is designed not just to protect against conventional SQLi attacks but also against JSON-based SQLi attacks, NoSQL injection attacks, hybrid attacks, and conventional WAF evasion techniques. The proposed system utilizes a stacking ensemble of Random Forest, Gradient Boosting, and Logistic Regression classifiers with manually constructed features that represent various properties of queries instead of using conventional static rule-based techniques or deep learning models. The detector is integrated into an application process that facilitates query inspection, batch analysis, decision explanation, and mitigation actions. The application is made available via a Flask-based REST API. To add structural variety, the dataset is constructed from public payload sources and augmented methodically. To support detections and to provide potential WAF rules, feature-level explanations are employed. The proposed work is also extended to incorporate a privacy-preserving federative learning framework to show its efficacy in collaborative environments. The system’s overall goal is to provide a modern, API-driven application as a complementary injection attack detection and monitoring layer suitable for quick, easy deployment.