Lilliane Linnet Musoke | Search arXiv

arXiv2026

Enhancing Web Application Firewalls with BERT-GNN for SQL Injection Detection

Detecting sophisticated SQL Injection (SQLi) attacks remains among the most critical challenges in web applications security. This research study has resulted in an optimised hybrid BERT-GNN pipeline with improved detection accuracy and robustness while reducing false-positive and false-negative rates. SQL queries are tokenised and encoded into contextual BERT embeddings, which then initialise the node features of a Graph Neural Network (GNN) trained to classify each query, with the architecture tuned by Optuna over accuracy, precision, recall, and F1-score. The proposed model achieved 99.67% accuracy, with 99.71% precision, 99.39% recall, and 99.55% F1-score on the attack class. A sensitivity analysis, performed by perturbing graph inputs, further assessed the model robustness and yielded a low mean sensitivity score of 0.0037, indicating stable predictions under such perturbations. The results have demonstrated the potential of a novel hybrid model that couples BERT contextual understanding with the GNN structural modelling to detect sophisticated SQLi attack vectors. For open validation, the dataset, test sets and models are made available at https://github.com/mlily2024/Final-project-SQL-injection-pipeline.

cs.CR↗

arXiv2026

Enhancing Web Application Firewalls with Machine Learning for SQL Injection Detection

Detecting SQL Injection (SQLi) attacks ranks among the most critical challenges in web application security. This research conducted a systematic literature review to identify the research gaps in this domain and responsively designed and optimised a DistilBERT-Stacked Ensemble pipeline to improve detection efficiency and robustness while reducing false-positive and false-negative rates. Comprehensive pre-processing and tokenisation were performed, DistilBERT embeddings were extracted, and machine-learning and ensemble classifiers were trained and ranked on accuracy, precision, recall and F1-score. The three best performers (Logistic Regression, XGBoost and SVM) were combined through a neural meta-learner to form a stacked ensemble. The ensemble was hardened with adversarial examples generated by the Fast Gradient Sign Method (FGSM) and tuned with Optuna. The optimised ensemble achieved 99.81% across all reported metrics, closely comparable to the strongest single model (DistilBERT SVM, 99.82%). On the evaluation platform used in this study (Section 3.8), the ensemble classified the full test set in 0.0136s against 1.896s for DistilBERT-SVM, an approximately 140-fold reduction in measured inference latency, while retaining 99.77% accuracy under a single-step FGSM attack. The contribution is the design and validation of a SQLi detector performing with state-of-the-art accuracy at real-time speed and with demonstrated robustness to a single-step FGSM attack, rather than a marginal gain in accuracy. Sensitivity analysis further confirmed the stability of the model. These findings highlight the value of adversarial training and stacked meta-learning in building robust Web Application Firewalls (WAFs) for SQLi detection. For open validation, the dataset, test sets and models are made available at https://github.com/mlily2024/Final-project-SQL-injection-pipeline.

cs.CR↗