Reproducibility and Cross-Scenario Generalization of NetFlow-Based SQL Injection Detection: Threshold Transfer and Feature Dependence

Abstract

Machine-learning detectors for SQL injection (SQLi) may perform well under internal evaluation yet fail to preserve a usable decision threshold across traffic scenarios. This study evaluates that transfer risk using two independently generated NetFlow V5 datasets. D1 (400,003 flows) is used only for training, preprocessing, feature selection, hyperparameter selection, and threshold calibration; D2 (57,229 flows) is reserved for final cross-scenario testing. Six classifiers are evaluated with corrected FAR = FP/(FP+TN), confusion-matrix consistency checks, with-IP/without-IP ablation, and computational timing. In the primary baseline, Logistic Regression with IP features yields 85.25% accuracy, 87.09% F1-score, 99.46% recall, and 28.96% FAR. Under a D1-validation operating point that minimizes FAR subject to recall of at least 95%, LinearSVC with IP features yields the strongest D2 result (91.96% accuracy, 92.52% F1-score, 99.54% recall, and 15.63% FAR), whereas Random Forest thresholds collapse to all-benign predictions. Removing IP-address features reduces calibrated LinearSVC accuracy to 89.88% and raises FAR to 19.78%, although its ROC-AUC and PR-AUC remain high. A controlled audit also fails to reproduce the approximately 98% Logistic Regression result reported in the earlier preprint. Threshold transfer, false-alarm behavior, and reproducibility are therefore central deployment concerns for flow-based SQLi detection.