Ensemble Machine Learning Approaches for Detection of SQL Injection Attack
In the current era, SQL Injection Attack is a serious threat to the security of the ongoing cyber world particularly for many web applications that reside over the internet. Many webpages accept the sensitive information (e.g. username, passwords, bank details, etc.) from the users and store this in...
| Main Author: | |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
University North
2021-01-01
|
| Series: | Tehnički Glasnik |
| Subjects: | |
| Online Access: | https://hrcak.srce.hr/file/367636 |
| _version_ | 1797206983157219328 |
|---|---|
| author | Umar Farooq |
| author_facet | Umar Farooq |
| author_sort | Umar Farooq |
| collection | DOAJ |
| description | In the current era, SQL Injection Attack is a serious threat to the security of the ongoing cyber world particularly for many web applications that reside over the internet. Many webpages accept the sensitive information (e.g. username, passwords, bank details, etc.) from the users and store this information in the database that also resides over the internet. Despite the fact that this online database has much importance for remotely accessing the information by various business purposes but attackers can gain unrestricted access to these online databases or bypass authentication procedures with the help of SQL Injection Attack. This attack results in great damage and variation to database and has been ranked as the topmost security risk by OWASP TOP 10. Considering the trouble of distinguishing unknown attacks by the current principle coordinating technique, a strategy for SQL injection detection dependent on Machine Learning is proposed. Our motive is to detect this attack by splitting the queries into their corresponding tokens with the help of tokenization and then applying our algorithms over the tokenized dataset. We used four Ensemble Machine Learning algorithms: Gradient Boosting Machine (GBM), Adaptive Boosting (AdaBoost), Extended Gradient Boosting Machine (XGBM), and Light Gradient Boosting Machine (LGBM). The results yielded by our models are near to perfection with error rate being almost negligible. The best results are yielded by LGBM with an accuracy of 0.993371, and precision, recall, f1 as 0.993373, 0.993371, and 0.993370, respectively. The LGBM also yielded less error rate with False Positive Rate (FPR) and Root Mean Squared Error (RMSE) to be 0.120761 and 0.007, respectively. The worst results are yielded by AdaBoost with an accuracy of 0.991098, and precision, recall, f1 as 0.990733, 0.989175, and 0.989942, respectively. The AdaBoost also yielded high False Positive Rate (FPR) to be 0.009. |
| first_indexed | 2024-04-24T09:15:41Z |
| format | Article |
| id | doaj.art-1af13812ab2b4ba48dcf0361782ed65f |
| institution | Directory Open Access Journal |
| issn | 1846-6168 1848-5588 |
| language | English |
| last_indexed | 2024-04-24T09:15:41Z |
| publishDate | 2021-01-01 |
| publisher | University North |
| record_format | Article |
| series | Tehnički Glasnik |
| spelling | doaj.art-1af13812ab2b4ba48dcf0361782ed65f2024-04-15T16:49:19ZengUniversity NorthTehnički Glasnik1846-61681848-55882021-01-0115111212010.31803/tg-20210205101347Ensemble Machine Learning Approaches for Detection of SQL Injection AttackUmar Farooq0Department of Computer Science & Technology (Cyber Security), Central University of Punjab, City Campus, Mansa Road, Bathinda 151001, Punjab, IndiaIn the current era, SQL Injection Attack is a serious threat to the security of the ongoing cyber world particularly for many web applications that reside over the internet. Many webpages accept the sensitive information (e.g. username, passwords, bank details, etc.) from the users and store this information in the database that also resides over the internet. Despite the fact that this online database has much importance for remotely accessing the information by various business purposes but attackers can gain unrestricted access to these online databases or bypass authentication procedures with the help of SQL Injection Attack. This attack results in great damage and variation to database and has been ranked as the topmost security risk by OWASP TOP 10. Considering the trouble of distinguishing unknown attacks by the current principle coordinating technique, a strategy for SQL injection detection dependent on Machine Learning is proposed. Our motive is to detect this attack by splitting the queries into their corresponding tokens with the help of tokenization and then applying our algorithms over the tokenized dataset. We used four Ensemble Machine Learning algorithms: Gradient Boosting Machine (GBM), Adaptive Boosting (AdaBoost), Extended Gradient Boosting Machine (XGBM), and Light Gradient Boosting Machine (LGBM). The results yielded by our models are near to perfection with error rate being almost negligible. The best results are yielded by LGBM with an accuracy of 0.993371, and precision, recall, f1 as 0.993373, 0.993371, and 0.993370, respectively. The LGBM also yielded less error rate with False Positive Rate (FPR) and Root Mean Squared Error (RMSE) to be 0.120761 and 0.007, respectively. The worst results are yielded by AdaBoost with an accuracy of 0.991098, and precision, recall, f1 as 0.990733, 0.989175, and 0.989942, respectively. The AdaBoost also yielded high False Positive Rate (FPR) to be 0.009.https://hrcak.srce.hr/file/367636Boostingensemble learningLight GBMSQL injectionweb security |
| spellingShingle | Umar Farooq Ensemble Machine Learning Approaches for Detection of SQL Injection Attack Tehnički Glasnik Boosting ensemble learning Light GBM SQL injection web security |
| title | Ensemble Machine Learning Approaches for Detection of SQL Injection Attack |
| title_full | Ensemble Machine Learning Approaches for Detection of SQL Injection Attack |
| title_fullStr | Ensemble Machine Learning Approaches for Detection of SQL Injection Attack |
| title_full_unstemmed | Ensemble Machine Learning Approaches for Detection of SQL Injection Attack |
| title_short | Ensemble Machine Learning Approaches for Detection of SQL Injection Attack |
| title_sort | ensemble machine learning approaches for detection of sql injection attack |
| topic | Boosting ensemble learning Light GBM SQL injection web security |
| url | https://hrcak.srce.hr/file/367636 |
| work_keys_str_mv | AT umarfarooq ensemblemachinelearningapproachesfordetectionofsqlinjectionattack |