An LDA-Enhanced Machine Learning Approach for Efficient SQL Injection Detection from Web Traffic Logs

Abstract

SQL injection (SQLI) remains a critical web application security threat, while conventional signature-based detection methods face limitations in identifying evolving attack patterns and handling high-dimensional web request data. This study proposes an improved machine learning framework for SQLI detection based on TF-IDF N-grams and Latent Dirichlet Allocation (LDA). HTTP requests from the CSIC-2010 and ECML/PKDD-2007 datasets are processed to extract SQLI-related traffic using SQL keyword-based filtering. TF-IDF trigram features are generated to represent request characteristics, followed by LDA-based dimensionality reduction to obtain a compact latent semantic representation. Support Vector Machine (SVM) and Random Forest (RF) classifiers are employed for classifying malicious and genuine requests. Experimental results demonstrate the effectiveness of the proposed LDA-based approach. On the CSIC-2010 dataset, the SVM and RF models achieve 99.90% and 98.13% accuracy, respectively. On the ECML/PKDD-2007 dataset, the improved framework achieves 98.70% accuracy using SVM and 99.85% using RF, with approximately 99% true-positive rate and mean ROC performance. The findings indicate that LDA-based feature reduction can improve the effectiveness and efficiency of machine-learning-based SQLI detection.