Enhancing SQL Injection Detection: A Machine Learning Approach Using Network Flow Data

Abstract

Background: SQL injection is one of the cyberattacks which occurs in web application vulnerabilities. It targets the poor input validation and enables the attackers to inject malicious queries into the database fields in any application. It will grant access to unauthorized users and data modification, or they will take control over the complete database. To prevent this, there are several traditional methods, like Intrusion Detection Systems (IDS) and packet inspection methods, which will detect these attacks by each and every network packet in the network traffic. Methods: The existing methods also have some limitations due to computational overhead due to monitoring each and every packet. It makes it challenging for high-end routers and large-scale networks as it monitors all the individual traffic. To resolve this problem, propose a flow-based detection method, making use of lightweight protocols like NetFlow and sFlow to identify SQLI attacks. Unlike traditional methods, which require more inspection on individual packets, flow-based analysis uses mandatory communication metadata, like source and destination IP addresses, port numbers, etc. It minimizes the need for computationally expensive packet inspection, which is going to render the process of detection more trustworthy and economical, particularly within high-traffic conditions. Results: In order to validate this approach, we gathered two collections of data, which included net flow data of SQLI attacks of database systems such as SQL, postgres SQL, etc. It has both normal and bad traffic, and we applied machine learning models to the traffic. Conclusion: The results indicate that the proposed flow-based method is more efficient and scalable for detecting SQL injection attacks than packet-based inspection.