An effective SQL injection detection model using LSTM for imbalanced datasets

Abstract

The rise of web application attacks, increasingly frequent and complex, presents a significant cybersecurity challenge. This rise is driven by the vast data available on the internet, attracting cybercriminals. Among these attacks, Structured Query Language Injection (SQLI) remains particularly pervasive and dangerous, threatening the security and integrity of critical databases. This enduring threat has encouraged extensive research to develop strategies for detecting SQLI attacks with high accuracy and low latency. This paper introduces two advanced models for SQLI detection using a Long Short-Term Memory (LSTM) neural network as a deep learning model and other traditional Machine Learning classifiers. A key challenge addressed in this study is data imbalance—a common issue in cybersecurity datasets where malicious instances are vastly outnumbered by benign ones. This imbalance can bias Machine Learning models toward the majority class. To counter this, the research employs a variety of data preprocessing techniques that significantly enhance model performance. Experimental results indicate significant improvements in performance metrics due to preprocessing. However, the standout finding is the superior performance of the proposed deep learning model, specifically the LSTM neural network. Without relying on resampling techniques, the LSTM model demonstrates exceptional accuracy in detecting SQLI attacks, beating the enhanced Machine Learning model. It is worth noting that the proposed LSTM model performance is tested on three different datasets to ensure its robustness and ability to adapt with varying environments. It achieves a perfect 100 % precision, recall, and F1-score. Its accuracy consistently ranged from 99.7 % to 99.8 % across all three datasets, with a remarkably low classification error of 0.002 that was nearly zero. These results highlight the LSTM model's robustness and effectiveness in addressing SQLI detection challenges, making it a powerful tool for enhancing cybersecurity defenses.