SQL Injection Detection Using a Stacking Ensemble Machine Learning Model

References

[1] Abenezer, T. (2022). Parameterized queries and prepared statements as a defense against SQL injection. Database Security Notes.

[2] Alghawazi, M., Alghazzawi, D., & Alarifi, S. (2022). Detection of SQL injection attack using machine learning techniques: A systematic literature review. Journal of Cybersecurity and Privacy, 2(4), 764–777.

[3] Ben Ammar, B., & Alharbi, A. M. (2025). SQL injection detection using fine-tuned CodeBERT. Engineering, Technology & Applied Science Research, 15(5), 27852–27857. https://doi.org/10.48084/etasr.13340

[4] Breiman, L. (2001). Random forests. Machine Learning, 45(1), 5–32. https://doi.org/10.1023/A:1010933404324

[5] Chen, T., & Guestrin, C. (2016). XGBoost: A scalable tree boosting system. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (pp. 785–794). ACM. https://doi.org/10.1145/2939672.2939785

[6] Chicco, D., & Jurman, G. (2020). The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation. BMC Genomics, 21(1), Article 6. https://doi.org/10.1186/s12864-019-6413-7

[7] Clarke, J. (2012). SQL Injection Attacks and Defense (2nd ed.). Syngress.

[8] Cortes, C., & Vapnik, V. (1995). Support-vector networks. Machine Learning, 20(3), 273–297. https://doi.org/10.1007/BF00994018

[9] Dasari, N. S., Badii, A., Moin, A., & Ashlam, A. (2025). Enhancing SQL injection detection and prevention using generative models.

[10] Fairoz, N., Siddeeq, S., Azar, D., & Dindar, S. (2021). Sensitive keyword filtering as a server-side SQL injection countermeasure. International Journal of Web Security.

[11] Forristal, J. (1998). NT Web technology vulnerabilities. Phrack Magazine, 8(54).

[12] Goodfellow, I., Bengio, Y., & Courville, A. (2016). Deep Learning. MIT Press. https://www.deeplearningbook.org/

[13] Halfond, W. G. J., Viegas, J., & Orso, A. (2006). A classification of SQL injection attacks and countermeasures. Proceedings of the IEEE International Symposium on Secure Software Engineering (pp. 13–15).

[14] Hosmer, D. W., Lemeshow, S., & Sturdivant, R. X. (2013). Applied Logistic Regression (3rd ed.). John Wiley & Sons.

[15] Ines, K., Omar, C., Habib, Y., & Adel, B. (2020). A taxonomy of SQL injection attack types. International Journal of Information Security Science.

[16] Lo, R.-T., Hwang, W.-J., & Tai, T.-M. (2025). SQL injection detection based on lightweight multi-head self-attention. Applied Sciences, 15(2), 571. https://doi.org/10.3390/app15020571

[17] Mamdouh, M., et al. (2021). SQL injection: Threats, detection techniques, and prevention mechanisms.

[18] Microsoft. (2023). Secure Coding Guidelines for Web Applications.

[19] Nenad, B., et al. (2022). The importance of developing preventive techniques for SQL injection attacks, 523–529.

[20] Neupane, S. (2025). Detecting and mitigating SQL injection vulnerabilities in web applications.

[21] OWASP. (2022). Blind SQL Injection. Open Web Application Security Project. https://owasp.org/www-community/attacks/Blind_SQL_Injection

[22] OWASP Foundation. (2021). OWASP Top 10: The ten most critical web application security risks. https://owasp.org/www-project-top-ten/

[23] Rosca, C.-M., Stancu, A., & Popescu, C. (2025). Machine learning models for SQL injection detection. Electronics, 14(17), 3420. https://doi.org/10.3390/electronics14173420

[24] Sagi, O., & Rokach, L. (2018). Ensemble learning: A survey. Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery, 8(4), e1249. https://doi.org/10.1002/widm.1249

[25] Sam, N. (2021). Whitelisting and input validation strategies for web application security. Journal of Applied Security Research.

[26] SANS Institute. (2024). SQL Injection Attacks and Prevention Techniques.

[27] Sefati, S. S., Arasteh, B., & Fratu, O. (2025). SSLA: A semi-supervised framework for real-time injection detection and anomaly monitoring in cloud-based web applications with real-world implementation and evaluation. Journal of Cloud Computing, 14(38). https://doi.org/10.1186/s13677-025-00765-6

[28] Stallings, W. (2018). Effects of Security Considerations on System Design. Pearson.

[29] Sundar, R. (2022). Principle of least privilege in database access control. Journal of Information Security Practice.

[30] Wolpert, D. H. (1992). Stacked generalization. Neural Networks, 5(2), 241–259. https://doi.org/10.1016/S0893-6080(05)80023-1

@article{1719702,
      author = {Ezema Promise Ogochukwu, Dr. Oluwasegun Ishaya Adelaiye, Abimaje Friday},
      title = {SQL Injection Detection Using a Stacking Ensemble Machine Learning Model},
      journal = {Iconic Research And Engineering Journals},
      year = {2026},
      volume = {10},
      number = {1},
      pages = {1074-1084},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1719702.pdf},
      abstract = {Structured Query Language (SQL) injection remains one of the most persistent and damaging vulnerabilities affecting database-driven web applications, allowing attackers to manipulate backend queries, exfiltrate sensitive data, and compromise system integrity. Conventional countermeasures such as input validation, parameterized queries, and signature-based filters struggle against novel or obfuscated attack payloads. This study presents a stacking ensemble machine learning model for SQL injection detection that combines Random Forest, Support Vector Machine (SVM), and Extreme Gradient Boosting (XGBoost) as base learners, with Logistic Regression acting as a meta-learner over out-of-fold prediction. A labelled corpus of 12,000 SQL statements (6,500 legitimate, 5,500 malicious) was cleaned, tokenized, and vectorized using Term Frequency-Inverse Document Frequency (TF-IDF) prior to training, and five-fold cross-validation was used throughout to guard against overfitting. The trained model was deployed inside a Flask/MySQL web application that screens submitted queries in real time. On a held-out test set, the stacking ensemble achieved 98.42% accuracy, 98.15% precision, 98.70% recall, a 98.42% F1-score, a ROC-AUC of 0.992, and a Matthews Correlation Coefficient of 0.968 — outperforming Decision Tree, standalone Random Forest, SVM, and XGBoost classifiers on every metric. These results indicate that stacking ensemble learning is a practical, high-accuracy complement to conventional defenses and merits adoption as an additional detection layer in web application security pipelines.},
      keywords = {SQL Injection, Stacking Ensemble Learning, Machine Learning, Web Application Security, Random Forest, Support Vector Machine, XGBoost, Logistic Regression, Cybersecurity.},
      month = {July},
      doi = {https://doi.org/10.64388/IREV10I1-1719702}
  }