Prototype for Identifying an Efficient Machine Learning Algorithm with Correlated Dataset to Detect Sqlia

Abstract

SQL Injection Attacks (SQLIA) are a widespread and frequently occurring security problem
in web-based applications. In SQLIA, attackers can take advantage of weak authentication
mechanisms and poorly secured web apps. The integrity and confidentiality of data are lost
because of the implementation of a SQLIA, which results in a reduction of the organization
value. These frequent attacks are carried mostly on websites. The recent, SQL injection attacks
are not widely understood by the general public and have gone unnoticed by many
researchers.in this proposed work various types of queries are collected to form a correlated
dataset that contains the most modern and subcategories of SQLIA queries like tautologies,
malformed queries, union queries, piggy-back queries, inference, and stored procedures. Due
to the complexity of detecting SQLIA, machine learning classifiers were used. Machine
learning algorithms such as Decision Tree, Random Forest, AdaBoost, KNNeighbors,
Stochastic Gradient, Extra Tree, and Gaussian Naive Bayer are used. The data collected is
preprocessed to refine the dataset. Feature extraction is performed on the dataset using the
Count Vectorizer. Training and testing are separately applied to the dataset to find the best
algorithm for detecting SQLIA. A prototype has been developed to identify efficient machine
learning algorithm in terms of accuracy, precision, recall, and F1 score. Among the seven
classifiers, Gaussian Naive Bayer’s achieved the highest accuracy of 97.74%. Other classifiers
also achieved a satisfactory result as most of the algorithm were above 85% accuracy. The
results show the effectiveness of machine learning techniques to identify the SQLIA.