PaperlayerView exact revision on arXiv

Source-linked AI summary

Enhancing Web Application Firewalls with Machine Learning for SQL Injection Detection

Lilliane Linnet Musoke, Atta Badii, Ahmed Ashlam

arXiv:2608.28889v1cs.CR

TL;DR

SQLi detection must address the limitations of existing WAF approaches and the underreported combination of accuracy, latency, and adversarial robustness. This paper builds a DistilBERT-stacked ensemble with adversarial training and tuning, achieving near-best-model accuracy at substantially lower measured latency while retaining FGSM robustness.

  • Problem

    Prior ML-WAF studies rarely report the joint trade-off among accuracy, inference latency, and adversarial robustness needed for real-time SQLi detection.

  • Method

    The paper combines DistilBERT embeddings with Logistic Regression, XGBoost, and SVM in a neural stacked ensemble hardened with FGSM training and tuned with Optuna.

  • Results

    0.01356s versus 1.896s: the optimised ensemble achieved 99.81% across all metrics, comparable to DistilBERT-SVM at 99.82%, and achieved 99.77% under single-step FGSM.

  • Takeaways & Limitations

    The results support a practical real-time WAF detector combining near-best-model accuracy with substantially lower measured inference latency and demonstrated single-step FGSM robustness.

  • Takeaways & Limitations

    The conventional-baseline comparison is not fully controlled because balancing and hyperparameter-tuning strategies differ, so part of the performance gap may reflect those strategies.

Abstract

from arXiv · show

Detecting SQL Injection (SQLi) attacks ranks among the most critical challenges in web application security. This research conducted a systematic literature review to identify the research gaps in this domain and responsively designed and optimised a DistilBERT-Stacked Ensemble pipeline to improve detection efficiency and robustness while reducing false-positive and false-negative rates. Comprehensive pre-processing and tokenisation were performed, DistilBERT embeddings were extracted, and machine-learning and ensemble classifiers were trained and ranked on accuracy, precision, recall and F1-score. The three best performers (Logistic Regression, XGBoost and SVM) were combined through a neural meta-learner to form a stacked ensemble. The ensemble was hardened with adversarial examples generated by the Fast Gradient Sign Method (FGSM) and tuned with Optuna. The optimised ensemble achieved 99.81% across all reported metrics, closely comparable to the strongest single model (DistilBERT SVM, 99.82%). On the evaluation platform used in this study (Section 3.8), the ensemble classified the full test set in 0.0136s against 1.896s for DistilBERT-SVM, an approximately 140-fold reduction in measured inference latency, while retaining 99.77% accuracy under a single-step FGSM attack. The contribution is the design and validation of a SQLi detector performing with state-of-the-art accuracy at real-time speed and with demonstrated robustness to a single-step FGSM attack, rather than a marginal gain in accuracy. Sensitivity analysis further confirmed the stability of the model. These findings highlight the value of adversarial training and stacked meta-learning in building robust Web Application Firewalls (WAFs) for SQLi detection. For open validation, the dataset, test sets and models are made available at https://github.com/mlily2024/Final-project-SQL-injection-pipeline.

1. Motivation and Contribution

SQLi poses a serious threat, while rule-based WAFs struggle with evolving and obfuscated attacks, errors, latency, and computational demands. The paper addresses the underreported joint trade-off among detection accuracy, inference latency, and adversarial robustness with a DistilBERT-stacked ensemble.

  • SQLi attacks can expose sensitive data and compromise underlying systems as web applications become more complex and data-intensive.
  • Rule-based and signature-matching WAFs struggle with zero-day and obfuscated SQLi, false positives and negatives, latency, and computational demands.
  • ML-based WAFs learn from diverse HTTP requests and adapt to new threats, but accuracy, computational cost, interpretability, and adversarial susceptibility remain challenges.
  • Prior ML-WAF studies rarely report the joint trade-off among accuracy, inference latency, and adversarial robustness required for real-time deployment.
  • The proposed ensemble combines DistilBERT embeddings with Logistic Regression, XGBoost, and SVM, then uses FGSM training and Optuna tuning to target deployability.

2. The DistilBERT-Stacked Ensemble

The proposed architecture converts SQL queries into DistilBERT embeddings, evaluates complementary classifiers, and stacks the top three through a neural meta-learner. FGSM training and Optuna tuning strengthen and optimise the ensemble.

  • DistilBERT converts raw SQL queries into contextual embeddings used by Logistic Regression, SVM, and XGBoost classifiers.
  • The top three classifiers are selected using cross-validated accuracy, precision, recall, and F1-score, then combined through class-probability meta-features.
  • The neural meta-learner uses a hidden ReLU layer, dropout regularisation, and a two-unit output layer for final class probabilities.
  • FGSM adversarial examples are injected during training, while Optuna tunes the architecture and training hyperparameters.
  • Figure 1 depicts 768-dimensional embeddings flowing through seven base models, with the top three supplying six meta-features to the final classifier.
  • The benchmark includes interpretable, tree-based, probabilistic, margin-based, and boosting classifiers to provide complementary modelling approaches.

3. Implementation

The implementation uses a labelled SQL-injection dataset with class imbalance, standardised query preprocessing, and correlation analysis over numeric fields. Balancing strategies address the minority attack class while retaining query variation.

  • The dataset contains 30,919 malicious or benign instances, with 63.2% benign and 36.8% SQLi queries.
  • Conventional models use SMOTE, whereas the DistilBERT-stacked ensemble uses class weights to balance the minority attack class.
  • Queries are lower-cased, whitespace-normalised, labelled, and split into training and test sets without removing length outliers.
  • Query_Length has a moderate positive correlation of 0.50 with Label, indicating that longer queries carry some maliciousness signal.

3.3 Tokenisation and DistilBERT Embeddings

Queries are tokenised with padding and truncation before DistilBERT generates contextual embeddings for all classifiers. Classifier hyperparameters are selected with five-fold GridSearchCV using accuracy scoring.

  • DistilBERT tokenisation applies padding and truncation to produce uniform embedding inputs.
  • DistilBERT generates multidimensional contextual embeddings encoding syntactic and semantic query details for classifier inputs.
  • GridSearchCV uses five-fold cross-validation and accuracy scoring to select hyperparameters for ML and ensemble classifiers.

3.5 Meta-Features, Meta-Learner and Optuna Optimisation

The pipeline constructs six-dimensional meta-features from top-three classifier probabilities and uses Optuna to optimise the stacked ensemble. SQL queries undergo cleaning, tokenisation, SQL-keyword preservation, lemmatisation, reconstruction, TF-IDF conversion and SMOTE balancing for conventional models.

  • Meta-Features: Six meta-features combine the two class probabilities from each of the three top-performing classifiers.The meta-features are generated through 5-fold cross_val_predict.
  • Meta-Learner: The top-three classifiers are selected using cross-validated performance and their probabilities are passed to a neural meta-learner.
  • Preprocessing: SQL-query preprocessing lowercases text, preserves SQL syntax characters, tokenises content, retains SQL keywords, lemmatises words and rejoins tokens.These steps standardise query text before numerical feature extraction.
  • Conventional Features: TF-IDF converts processed queries into numerical vectors, after which conventional-model features are balanced with SMOTE.The representation assigns weights according to word frequency and supports dimensionality reduction and normalisation.

3.7 Evaluation

Evaluation measures classification quality, execution latency and statistical significance, with additional sensitivity and FGSM robustness analyses to assess deployment-relevant behaviour.

  • Evaluation Measures: Accuracy, precision, recall and F1-score are measured alongside full-test-set wall-clock latency.Latency is recorded to gauge real-world viability.
  • Statistical Testing: McNemar's exact test evaluates whether the paired accuracy difference between the stacked ensemble and strongest single model is statistically significant.
  • Robustness Analysis: Sensitivity analysis perturbs input features and measures average prediction changes, while FGSM evaluation measures adversarial accuracy.

3.8 Experimental platform

Experiments run on Google Colab Pro using an NVIDIA Tesla T4 GPU runtime, with DistilBERT and the neural meta-learner on GPU and conventional classifiers on CPU.

  • Computing Platform: Google Colab Pro with an NVIDIA Tesla T4 GPU runtime provides the experimental platform.
  • Execution Allocation: DistilBERT embeddings and the neural meta-learner are computed on GPU, whereas scikit-learn base classifiers run on the runtime CPU.
  • Timing and Optimisation: Optuna performs hyperparameter optimisation, and reported training and execution times, including inference latencies, are measured on this platform.

4. Results

The optimised DistilBERT-Stacked Ensemble achieves near-best classification performance with substantially lower measured latency than DistilBERT-SVM, while showing FGSM and sensitivity robustness. Comparisons with TF-IDF baselines are favourable but not fully controlled, and query-level obfuscation reveals a practical evasion boundary.

  • Base classifiers under DistilBERT embeddings: 99.82% accuracy makes DistilBERT-SVM the strongest single model, while Logistic Regression and XGBoost provide 0.017s and 0.042s execution times.
  • Optimised stacked ensemble: 99.81% across all metrics is achieved by the optimised DistilBERT-Stacked Ensemble, with 99.77% adversarial accuracy under single-step FGSM.The optimised result improves on the pre-optimisation 99.79% by 0.02 percentage points.
  • Optimised stacked ensemble: 0.01356s full-test-set execution is roughly 140× faster than DistilBERT-SVM's 1.896s.The comparison covers 6,184 test samples on the reported computing platform.
  • Sensitivity analysis: 0.0005 average sensitivity indicates that predictions shift only moderately under feature perturbations.Features 2, 4 and 5 are the most influential, while features 0, 1 and 3 are less influential.
  • Comparison with conventional ML/ensemble baselines: 99.81% across all metrics and 0.01356s execution surpass the reported conventional TF-IDF baselines, but the comparison is not fully controlled.The ensemble uses class weighting and per-model GridSearchCV, whereas conventional baselines use SMOTE and default hyperparameters.
  • Query-level evasion robustness: 96.4% ensemble recall under inline-comment obfuscation identifies query-level evasion as a practical robustness boundary.The ensemble is invariant to case and whitespace rewrites and degrades only marginally under URL-encoding.

5. Conclusions

The optimised DistilBERT-Stacked Ensemble combines top-tier SQLi detection with substantially lower measured latency and quantified adversarial robustness, supporting real-time WAF deployment. The dataset, test sets and models are openly available for validation.

  • 99.81% performance across all reported metrics was achieved, with 99.77% adversarial accuracy under single-step FGSM at ε = 0.10.The ensemble was closely comparable to DistilBERT-SVM at 99.82%, with the difference confirmed as not statistically significant by McNemar’s exact test.
  • 0.0136s versus 1.896s yielded roughly 140× lower measured inference latency than DistilBERT-SVM on the study’s evaluation platform.This combination of accuracy, latency and adversarial robustness supports the ensemble’s use for real-time WAF detection.
  • Adversarial training and stacked meta-learning provide a practical framework for robust real-time SQLi detection in WAFs.The conclusion frames these techniques as valuable for web-application security.
  • The dataset, test sets and models are available openly for validation.The materials are provided through the project’s GitHub repository.

6. Future Work

Future work focuses on improving generalisation, reducing dependence on labelled data, strengthening adversarial resilience, and validating the pipeline in dynamic WAF settings.

  • The SQLi dataset should be expanded and diversified to improve generalisation to novel attack vectors.
  • Semi-supervised or unsupervised learning should be explored to reduce the labelled-data burden.
  • Stronger adversarial-training methods should be developed to sustain robustness against emerging threats.
  • The pipeline should be validated through dynamic, real-time WAF integration and fine-tuned against specific obfuscation techniques.The cited examples include encryption, code and data obfuscation, and steganography.
Loading 2608.28889v1…