Investigation of machine learning methods for detecting SQL injections

Abstract

Introduction. The paper addresses the task of detecting SQL injections in HTTP requests using machine learning methods. The models were trained on a dataset containing over 120,000 HTTP requests, classified into legitimate requests and those containing SQL injections. Each request was represented by a set of features, the dimensionality of which was reduced using the Principal Component Analysis method. The number of components used for the study of each model ranged from 2 to 14. Materials and methods. The study involves various models: Probabilistic Neural Network (PNN), Naive Bayes, Multilayer Perceptron with the RProp algorithm, Fuzzy Rule, k-Nearest Neighbors (KNN), Random Forest, Decision Tree, and Gradient Boosted Trees. The quality assessment is performed using recall and precision metrics for attack detection. Overfitting is evaluated using the ROC-AUC metric. Results and discussion. The effectiveness of different models was studied. Among the selected models, the Probabilistic Neural Network stands out in terms of performance metrics. With 3 principal components, the recall value is 0.996, and the attack detection precision is 0.81. Conclusion. The obtained result demonstrates that the model detects nearly all SQL injections, but classifies some legitimate requests as malicious.