Home / Current Issue / Paper 1719702
SQL Injection Detection Using a Stacking Ensemble Machine Learning Model
Subject area: Science,Engineering and Technology · Area of research: Machine Learning
DOI: https://doi.org/10.64388/IREV10I1-1719702
Abstract
Structured Query Language (SQL) injection remains one of the most persistent and damaging vulnerabilities affecting database-driven web applications, allowing attackers to manipulate backend queries, exfiltrate sensitive data, and compromise system integrity. Conventional countermeasures such as input validation, parameterized queries, and signature-based filters struggle against novel or obfuscated attack payloads. This study presents a stacking ensemble machine learning model for SQL injection detection that combines Random Forest, Support Vector Machine (SVM), and Extreme Gradient Boosting (XGBoost) as base learners, with Logistic Regression acting as a meta-learner over out-of-fold prediction. A labelled corpus of 12,000 SQL statements (6,500 legitimate, 5,500 malicious) was cleaned, tokenized, and vectorized using Term Frequency-Inverse Document Frequency (TF-IDF) prior to training, and five-fold cross-validation was used throughout to guard against overfitting. The trained model was deployed inside a Flask/MySQL web application that screens submitted queries in real time. On a held-out test set, the stacking ensemble achieved 98.42% accuracy, 98.15% precision, 98.70% recall, a 98.42% F1-score, a ROC-AUC of 0.992, and a Matthews Correlation Coefficient of 0.968 — outperforming Decision Tree, standalone Random Forest, SVM, and XGBoost classifiers on every metric. These results indicate that stacking ensemble learning is a practical, high-accuracy complement to conventional defenses and merits adoption as an additional detection layer in web application security pipelines.
Keywords
SQL Injection, Stacking Ensemble Learning, Machine Learning, Web Application Security, Random Forest, Support Vector Machine, XGBoost, Logistic Regression, Cybersecurity.
How to cite this paper
@article{1719702,
author = {Ezema Promise Ogochukwu, Dr. Oluwasegun Ishaya Adelaiye, Abimaje Friday},
title = {SQL Injection Detection Using a Stacking Ensemble Machine Learning Model},
journal = {Iconic Research And Engineering Journals},
year = {2026},
volume = {10},
number = {1},
pages = {1074-1084},
issn = {2456-8880},
url = {https://www.irejournals.com/formatedpaper/1719702.pdf},
abstract = {Structured Query Language (SQL) injection remains one of the most persistent and damaging vulnerabilities affecting database-driven web applications, allowing attackers to manipulate backend queries, exfiltrate sensitive data, and compromise system integrity. Conventional countermeasures such as input validation, parameterized queries, and signature-based filters struggle against novel or obfuscated attack payloads. This study presents a stacking ensemble machine learning model for SQL injection detection that combines Random Forest, Support Vector Machine (SVM), and Extreme Gradient Boosting (XGBoost) as base learners, with Logistic Regression acting as a meta-learner over out-of-fold prediction. A labelled corpus of 12,000 SQL statements (6,500 legitimate, 5,500 malicious) was cleaned, tokenized, and vectorized using Term Frequency-Inverse Document Frequency (TF-IDF) prior to training, and five-fold cross-validation was used throughout to guard against overfitting. The trained model was deployed inside a Flask/MySQL web application that screens submitted queries in real time. On a held-out test set, the stacking ensemble achieved 98.42% accuracy, 98.15% precision, 98.70% recall, a 98.42% F1-score, a ROC-AUC of 0.992, and a Matthews Correlation Coefficient of 0.968 — outperforming Decision Tree, standalone Random Forest, SVM, and XGBoost classifiers on every metric. These results indicate that stacking ensemble learning is a practical, high-accuracy complement to conventional defenses and merits adoption as an additional detection layer in web application security pipelines.},
keywords = {SQL Injection, Stacking Ensemble Learning, Machine Learning, Web Application Security, Random Forest, Support Vector Machine, XGBoost, Logistic Regression, Cybersecurity.},
month = {July},
doi = {https://doi.org/10.64388/IREV10I1-1719702}
}