Enhanced SQL injection detection using chi-square feature selection and machine learning classifiers.

Area of Science:

• Cybersecurity and Machine Learning
• Data Science and Network Security

Background:

• Structured Query Language (SQL) injection attacks are a prevalent and costly web threat, responsible for over 20% of global cyberattack expenses.
• Existing SQL injection detection methods struggle with high false positive rates and suboptimal accuracy due to the dynamic nature of these attacks.

Purpose of the Study:

• To propose an enhanced method for detecting SQL injection vulnerabilities by integrating Chi-square feature selection with machine learning models.
• To evaluate the impact of feature selection on the performance of various classification algorithms for improved SQL injection detection accuracy.

Main Methods:

• A hybrid dataset was created by merging custom data with the SQLiV3.csv dataset.
• Term Frequency-Inverse Document Frequency (TF-IDF) was employed for converting SQL queries into numerical feature vectors.
• Chi-square feature selection was applied to identify and retain the most relevant features, followed by testing five machine learning classifiers (multinomial Naïve Bayes, SVM, logistic regression, decision tree, KNN).

Main Results:

• Chi-square feature selection demonstrably improved classification performance across all tested models by mitigating noise and removing redundant features.
• The Decision Tree and K-Nearest Neighbors (KNN) models exhibited significant performance gains post-feature selection.
• The Decision Tree classifier achieved the highest accuracy (99.73%), precision (99.72%), recall (99.70%), and F1-score (99.71%), with a low false positive rate (0.25%) and misclassification rate (0.27%).

Conclusions:

• Feature selection is critical for enhancing the accuracy and reducing the false positive rates in high-dimensional data environments for SQL injection detection.
• The study establishes feature selection as a vital component in developing reliable and effective SQL injection detection systems, particularly for improving ensemble and tree-based models.