MACHINE LEARNING FOR WEB VULNERABILITY DETECTION: THE CASE OF CROSS-SITE REQUEST FORGERY

Abstract

Web applications have become an essential part of modern digital services, supporting activities such as online banking, e-commerce, healthcare, education, and government operations. However, the increasing dependence on web applications has also led to a rapid rise in cyberattacks that exploit security vulnerabilities, resulting in data breaches, financial losses, and unauthorized access to sensitive information. Traditional vulnerability detection methods, including manual code reviews and rule-based security scanners, often require significant time, expertise, and computational resources, while struggling to identify newly emerging or complex attack patterns. To address these challenges, this project presents a Machine Learningbased approach for Web Vulnerability Detection that automatically analyzes web application features and classifies them as secure or vulnerable. The proposed system involves collecting vulnerability-related datasets, performing data preprocessing to remove inconsistencies, extracting meaningful security features, and training supervised machine learning algorithms such as Decision Tree, Random Forest, Support Vector Machine (SVM), Logistic Regression, and Naïve Bayes to recognize patterns associated with common web vulnerabilities, including SQL Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Command Injection, and File Inclusion attacks. The trained model evaluates incoming data, predicts potential security threats with high accuracy, and enables early detection of vulnerabilities before they can be exploited by attackers. By continuously learning from historical data, the system enhances its capability to detect both known and previously unseen attack behaviors, thereby improving the overall effectiveness of web security. The proposed framework reduces manual effort, increases detection speed, minimizes false alarms, and provides a scalable and cost-effective solution for securing modern web applications.