Evaluation of two machine learning approaches for SQL injection detection : Comparing RoBERTa-SQLi and LSTM+RF for the classification of SQL injections using a quasi-experiment

Sammanfattning

SQL injection (SQLi) is a cybersecurity threat used by malicious users to modify or retrieve data from SQL databases. Improper detection of SQLi queries is a common security threat in today’s internet-facing systems. However, existing studies predominantly evaluate machine learning (ML) models using intra-dataset splits, where both training and testing data originate from the same dataset. In practice, ML models are exposed to previously unseen SQLi attacks that may differ significantly in structure, obfuscation techniques, and distribution. Consequently, their effectiveness on new, unseen SQLi data remains uncertain. This thesis was conducted with the primary goal of investigating the classification and generalization ability of two ML models in detecting SQLi attacks. The evaluated architectures include RoBERTa-SQLi and a hybrid model that combines Long Short-Term Memory (LSTM) with Random Forest, based on related research in this domain. The study employs a quasi-experiment, in which both models are trained and tested on the same three distinct datasets of varying composition and distribution. Experimental results show that the hybrid model achieves higher recall and F1-score, indicating stronger detection capability. The hybrid model also requires less memory and storage and achieves faster inference compared to RoBERTa-SQLi, making it more suitable for lightweight deployment. In contrast, RoBERTa-SQLi demonstrates a superior AUROC score, indicating stronger discriminative capability. However, the findings suggest a trade-off between detection sensitivity and discriminative capability, providing a better understanding of how the two ML models behave on unseen SQLi data.