Enhancing Web Application Firewall with Ensemble Machine Learning to Detect SQL Injection Attacks

SQL injection remains a persistent threat to web applications, capable of bypassing conventional defenses through obfuscation and evasion techniques. This work presents a hybrid Web Application Firewall (WAF) method combining an ensemble machine learning model with a light-weight heuristic filter to detect SQL injection vulnerabilities. The system reduces false positives and improves detection accuracy using a stacking ensemble of Random Forest, Logistic Regression, and XGBoost. After pre-processing and interception, incoming HTTP requests are selectively forwarded via a lightweight Lua-Python pipeline using Unix sockets to the ML model. With a one percent false positive rate and consistent low-latency performance, evaluation against ModSecurity with OWASP Core Rule Set shows that the proposed system achieves exceptional accuracy (99.04 percent), and AUC (0.998). These results imply that WAFs can be practi-cally improved in identifying obfuscated and advanced SQL by combining machine learning with rule-based detection.