{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,17]],"date-time":"2026-09-17T18:49:02Z","timestamp":1789670942279,"version":"4.0.1"},"reference-count":32,"publisher":"PeerJ","license":[{"start":{"date-parts":[[2025,7,16]],"date-time":"2025-07-16T00:00:00Z","timestamp":1752624000000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"abstract":"<jats:p>The increasing reliance on web applications for storing sensitive data and financial transactions has elevated the importance of web application security. A machine learning-based web application firewall was designed to protect web applications against injection vulnerabilities. A hybrid dataset, including CISC 2010, HTTPParams 2015, and real-time Hypertext Transfer Protocol (HTTP) requests, was employed. The study evaluated five classification algorithms\u2014K-nearest neighbors, logistic regression, na\u00efve Bayes, support vector machine, and decision tree\u2014for detecting cross site scripting (XSS), Structured Query Language (SQL) Injection, Operating System Command Injection, and Local File Inclusion attacks. Decision tree was identified as the algorithm with the highest precision, accuracy, recall, F1-score, receiver operating characteristic (ROC), and area under the curve (AUC) values. According to the confusion matrix analysis, the real-time tested web application firewalls (WAF) achieved a remarkably high F1 score of 93.13% and accuracy of 93.27%. The findings indicate that machine learning-based WAFs effectively protect web applications against injection threats. Future work includes expanding the WAF to cover other attack types and testing it on different datasets.<\/jats:p>","DOI":"10.7717\/peerj-cs.2975","type":"journal-article","created":{"date-parts":[[2025,7,16]],"date-time":"2025-07-16T08:08:57Z","timestamp":1752653337000},"page":"e2975","source":"Crossref","is-referenced-by-count":10,"title":["Web application firewall based on machine learning models"],"prefix":"10.7717","volume":"11","author":[{"given":"Muhammed Ersin","family":"Durmu\u015fkaya","sequence":"first","affiliation":[{"name":"Department of Computer Engineering, Istanbul Kultur University, Istanbul, Turkey"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Selim","family":"Bayrakl\u0131","sequence":"additional","affiliation":[{"name":"Department of Computer Engineering, Turkish Air Force Academy, National Defence University, Istanbul, Turkey"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"4443","published-online":{"date-parts":[[2025,7,16]]},"reference":[{"key":"10.7717\/peerj-cs.2975\/ref-1","doi-asserted-by":"publisher","first-page":"844","DOI":"10.22214\/IJRASET.2024.58946","article-title":"Real-time detection of network traffic anomalies in big data environments using deep learning models","volume":"12","author":"Arjunan","year":"2024","journal-title":"International Journal for Research in Applied Science and Engineering Technology"},{"issue":"4","key":"10.7717\/peerj-cs.2975\/ref-2","doi-asserted-by":"publisher","first-page":"2073","DOI":"10.3390\/S23042073","article-title":"Deep learning technique-enabled web application firewall for the detection of web attacks","volume":"23","author":"Dawadi","year":"2023","journal-title":"Sensors"},{"key":"10.7717\/peerj-cs.2975\/ref-3","article-title":"ml-based-waf-mitmproxy-tool","author":"Durmuskaya","year":"2024","unstructured":"GitHub repository. https:\/\/github.com\/ersindurmuskaya\/ml-based-waf-mitmproxy-tool\/tree\/main\/waf"},{"key":"10.7717\/peerj-cs.2975\/ref-4","article-title":"Genetic auto-prompt learning for pre-trained code intelligence language models","author":"Feng","year":"2024"},{"key":"10.7717\/peerj-cs.2975\/ref-5","doi-asserted-by":"publisher","DOI":"10.1109\/KBEI.2015.7436148","article-title":"Comparative approach to web application firewalls","author":"Ghanbari","year":"2015"},{"key":"10.7717\/peerj-cs.2975\/ref-6","first-page":"64 07\u2019","volume-title":"HTTP data set CSIC 2010. Information Security Institute of CSIC (Spanish Research National Council)","author":"Gim\u00e9nez","year":"2010"},{"issue":"2","key":"10.7717\/peerj-cs.2975\/ref-7","doi-asserted-by":"publisher","first-page":"313","DOI":"10.54614\/electrica.2022.22031","article-title":"Multiple classification of cyber-attacks using machine learning","volume":"22","author":"Guven","year":"2022","journal-title":"Electrica"},{"key":"10.7717\/peerj-cs.2975\/ref-8","doi-asserted-by":"publisher","first-page":"516","DOI":"10.1109\/ICIMTech50083.2020.9210946","article-title":"XSS attack detection with machine learning and n-Gram methods","author":"Habibi","year":"2020"},{"key":"10.7717\/peerj-cs.2975\/ref-9","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/ICCCI56745.2023.10128470","article-title":"Cross site scripting (XSS) vulnerability detection using machine learning and statistical analysis","author":"Harish\u00a0Kumar","year":"2023"},{"key":"10.7717\/peerj-cs.2975\/ref-10","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/ICETA.2015.7558466","article-title":"Commercial and open-source based intrusion detection system and intrusion prevention system (IDS\/IPS) design for an IP networks","author":"Hock","year":"2015"},{"key":"10.7717\/peerj-cs.2975\/ref-11","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/IISEC54230.2021.9672335","article-title":"Machine learning based web application firewall","author":"Isiker","year":"2021"},{"key":"10.7717\/peerj-cs.2975\/ref-12","doi-asserted-by":"publisher","first-page":"99","DOI":"10.1007\/978-3-031-50051-0_8","article-title":"Empirical evaluations of machine learning effectiveness in detecting web application attacks","volume-title":"Future access enablers for ubiquitous and intelligent infrastructures. FABULOUS 2023","volume":"vol. 542","author":"Ismail","year":"2023"},{"key":"10.7717\/peerj-cs.2975\/ref-13","doi-asserted-by":"publisher","first-page":"265","DOI":"10.1109\/GloSIC50886.2020.9267866","article-title":"The detecting cross-site scripting (XSS) using machine learning methods","author":"Kascheev","year":"2020"},{"key":"10.7717\/peerj-cs.2975\/ref-14","article-title":"Intelligent system using machine learning techniques for security assessment and cyber intrusion detection","author":"Kassem","year":"2021","journal-title":"PhD dissertation"},{"key":"10.7717\/peerj-cs.2975\/ref-15","doi-asserted-by":"crossref","DOI":"10.1109\/TSE.2023.3343716","article-title":"DaNuoYi: evolutionary multi-task injection testing on web application firewalls","author":"Li","year":"2023","journal-title":"IEEE Transactions on Software Engineering"},{"key":"10.7717\/peerj-cs.2975\/ref-16","doi-asserted-by":"publisher","first-page":"417","DOI":"10.1145\/3319619.3322026","article-title":"Security testing of web applications: a search-based approach for detecting SQL injection vulnerabilities","author":"Liu","year":"2019"},{"key":"10.7717\/peerj-cs.2975\/ref-17","first-page":"79","article-title":"Bypassing web application firewalls","author":"Luptk","year":"2011"},{"key":"10.7717\/peerj-cs.2975\/ref-18","article-title":"mitmproxy. mitmproxy docs","author":"mitmproxy","year":"2024"},{"key":"10.7717\/peerj-cs.2975\/ref-19","article-title":"Httpparams","author":"Morzeux","year":"2020"},{"issue":"3","key":"10.7717\/peerj-cs.2975\/ref-20","doi-asserted-by":"publisher","first-page":"709","DOI":"10.3390\/S22030709","article-title":"Predicting attack pattern via machine learning by exploiting stateful firewall as virtual network function in an SDN network","volume":"22","author":"Prabakaran","year":"2022","journal-title":"Sensors"},{"issue":"1","key":"10.7717\/peerj-cs.2975\/ref-21","doi-asserted-by":"publisher","first-page":"e13505","DOI":"10.1111\/exsy.13505","article-title":"Artificial intelligence web application firewall for advanced detection of web injection attacks","volume":"42","author":"Rom\u00e1n-Gallego","year":"2023","journal-title":"Expert Systems"},{"key":"10.7717\/peerj-cs.2975\/ref-22","article-title":"Xss injection dataset. Kaggle","author":"Shah","year":"2019"},{"key":"10.7717\/peerj-cs.2975\/ref-23","article-title":"sql injection dataset. Kaggle","author":"Shah","year":"2021"},{"key":"10.7717\/peerj-cs.2975\/ref-24","article-title":"waf","author":"Shaheed","year":"2021"},{"key":"10.7717\/peerj-cs.2975\/ref-25","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1155\/2022\/5280158","article-title":"Web application firewall using machine learning and features engineering","volume":"2022","author":"Shaheed","year":"2022","journal-title":"Security and Communication Networks"},{"issue":"6","key":"10.7717\/peerj-cs.2975\/ref-26","doi-asserted-by":"publisher","first-page":"688","DOI":"10.1109\/TDSC.2014.2373377","article-title":"Web application vulnerability prediction using hybrid program analysis and machine learning","volume":"12","author":"Shar","year":"2015","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"10.7717\/peerj-cs.2975\/ref-27","doi-asserted-by":"publisher","first-page":"8","DOI":"10.1016\/S1353-4858(18)30024-2","article-title":"We need to talk about ids signatures","volume":"3","author":"Shipulin","year":"2018","journal-title":"Network Security"},{"issue":"1","key":"10.7717\/peerj-cs.2975\/ref-28","doi-asserted-by":"publisher","first-page":"16","DOI":"10.48550\/arXiv.1001.3479","article-title":"A holistic approach to securing web applications","volume":"2","author":"Stankovic","year":"2010","journal-title":"Journal of Computing"},{"key":"10.7717\/peerj-cs.2975\/ref-29","doi-asserted-by":"publisher","first-page":"252","DOI":"10.1145\/3532213.3532251","article-title":"URL based file inclusion attack behavior analysis and an autoencoder detection model","author":"Tao","year":"2022"},{"issue":"12","key":"10.7717\/peerj-cs.2975\/ref-30","first-page":"1763","article-title":"Moving towards positive security model for web application firewall","volume":"6","author":"Yaacob","year":"2012","journal-title":"International Scholarly and Scientific Research & Innovation"},{"key":"10.7717\/peerj-cs.2975\/ref-31","doi-asserted-by":"publisher","first-page":"2285","DOI":"10.1145\/3660808","article-title":"Evolutionary multi-objective optimization for contextual adversarial example generation","volume":"1","author":"Zhou","year":"2024","journal-title":"Proceedings of the ACM on Software Engineering"},{"key":"10.7717\/peerj-cs.2975\/ref-32","doi-asserted-by":"publisher","first-page":"469","DOI":"10.1145\/3520304.3528981","article-title":"Adversarial example generation via genetic algorithm: a preliminary result","author":"Zhou","year":"2022"}],"container-title":["PeerJ Computer Science"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/peerj.com\/articles\/cs-2975.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-2975.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-2975.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/peerj.com\/articles\/cs-2975.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,16]],"date-time":"2025-07-16T08:09:02Z","timestamp":1752653342000},"score":1,"resource":{"primary":{"URL":"https:\/\/peerj.com\/articles\/cs-2975"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,16]]},"references-count":32,"alternative-id":["10.7717\/peerj-cs.2975"],"URL":"https:\/\/doi.org\/10.7717\/peerj-cs.2975","archive":["CLOCKSS","LOCKSS","Portico"],"relation":{},"ISSN":["2376-5992"],"issn-type":[{"value":"2376-5992","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,7,16]]},"article-number":"e2975"}}