An Ensemble Machine Learning Approach for Web Application Vulnerability Detection Using Textual Analysis

Abstract

With the rapid expansion of web-based applications and services, ensuring the security of
these systems has become a critical concern. Web applications are frequently targeted by
attackers exploiting vulnerabilities such as SQL Injection and Cross-Site Scripting (XSS),
which can lead to unauthorized data access, data leakage, and system compromise.
Traditional rule-based detection systems often fail to identify evolving attack patterns,
making intelligent and adaptive solutions necessary. This research proposes an ensemble
machine learning-based system for detecting vulnerabilities in textual input data using
advanced natural language processing techniques.The proposed system leverages a
combination of supervised learning algorithms, including Support Vector Machines
(SVM), K-Nearest Neighbors (KNN), and Gaussian Naive Bayes (GNB), integrated
through a Voting Classifier mechanism. A Term Frequency-Inverse Document Frequency
(TF-IDF) vectorizer is employed to convert raw textual data into meaningful numerical
features. The system is designed to analyze input strings, such as user queries or code
snippets, and classify them into categories including Normal, SQL Injection, and
JavaScript vulnerabilities.
The architecture includes a model initialization phase that loads pre-trained models or
trains new models using labeled datasets. During training, the dataset undergoes
preprocessing, feature extraction, and splitting into training and testing subsets. The
ensemble classifier is trained on these features to improve prediction accuracy and
robustness. The system also supports file-based prediction, allowing users to upload test
datasets and obtain real-time classification results.Experimental results demonstrate that
the ensemble model outperforms individual classifiers in terms of accuracy, precision,
recall, and F1-score. The combination of multiple models helps mitigate individual
weaknesses and enhances detection performance across diverse attack patterns