A Robust Machine Learning and Deep Learning Framework for SQL Injection Attack Detection Using Comprehensive Multi-Source Datasets

SQL Injection (SQLI) remains a critical threat to web application security. Traditional defense methods based on blocklists are ineffective against evolving attacks, while existing machine learning (ML) and deep learning (DL) approaches suffer from limited datasets and thus poor generalization. In this paper, we propose a robust method for detecting SQLI payloads using ML and DL models. Our approach addresses these limitations by: (۱) constructing a comprehensive and balanced dataset from multiple sources; and (۲) identifying ۱۹ distinguishing features through feature importance analysis. We evaluate eight models across three datasets by performing systematic hyper-parameter tuning. The random forest model achieves the best performance with ۹۹.۷% accuracy, precision, recall, and F۱-score, while maintaining a compact model size (۶۹۵ KB) and fast prediction speed (۰.۱۱۷ s). Our comparison with existing methods highlights the necessity of unbiased datasets and cross-dataset evaluation to reveal true model weaknesses. Importantly, our experimental results indicate that DL models do not offer a significant advantage over classical ML algorithms in this context; instead, with a sufficiently comprehensive and unbiased dataset, traditional ML methods such as random forest can achieve superior or comparable performance with greater efficiency. The proposed method offers an efficient and practical solution for SQLI detection, suitable for real-time applications such as Web Application Firewalls and web proxies.

کلیدواژه ها:

Web Security ، SQL injection detection ، Machine Learning (ML) ، Deep Learning (DL) ، Dataset