Cyberthreat Forensics Using AI-Neutrosophic Reasoning for SQL Injection Detection in Web Applications

Abstract

SQL Injection (SQLi) is a type of threat that is among the most resilient to web applications, as it allows an antagonist to alter the backend database and steal valuable information. The simplest detectors, effective in conforming patterns, fail to function with an obfuscation scheme and are characterised by a high false alarm rate in general. The article prescribes an AI-Neutrosophic Forensic Framework, a machine-learning classifier powered by neutrosophic rationale needed to create a more practical and intuitively understandable forensic specification. The framework ranks open source SQLi datasets and web application honeypot logs and identifies structural query features and semantic query features. A hybrid encoder of both Decision Tree and Support Vector Machine produces probability estimates, which are, in turn, converted to a neutrosophic stimulus of truth, falsity, and indeterminacy. This indeterminacy is alleviated in marginal cases. The results presented in the 10000 SQL query simulation indicate that the framework has an accuracy and precision of 97.86 and 96.45, respectively, a recall of 98.21 with a F1-score of 97.32, a false positive value of 2.1 and a false negative value of 1.9, and an average latency to detect parallels of 12.6 ms. The proposed framework has demonstrated that the error levels have substantially reduced and that is able to provide forensics data that is meaningful when analysing web applications in comparison to the original AI-only practices.