article · Journal of King Saud University - Computer and Information Sciences
Web-based software vulnerabilities represent significant targets for cybercriminals, threatening critical systems in Industry 5.0 environments. An empirical evaluation compared traditional single supervised machine learning classifiers against homogeneous and heterogeneous ensemble methods using two realistic public benchmark datasets. The evaluation assessed five individual classifiers, heterogeneous combinations using stacking and max voting, and homogeneous models using bagging and boosting. Bagging, particularly Random Forest, achieved the best overall performance, delivering over 99.5 percent accuracy alongside very low false positive rates. Single classifiers outperformed boosting and stacking overall, whilst requiring less training time as data volumes grew. Max voting proved optimal when precision and accuracy were paramount, whereas single classifiers remained preferable when rapid training, low prediction latency, and low false negative rates were the primary operational requirements.
Web attacks present serious operational risks to connected industrial networks. By demonstrating which machine learning architectures deliver top detection accuracy versus those offering faster computational processing, this evaluation helps cybersecurity teams select appropriate tools to defend web applications. It allows organisations to deliberately balance threat detection precision against computational overhead.
This research provides algorithmic benchmarks to help cybersecurity practitioners select detection models for web application security software. The findings are at an applied research stage, validated on two standard public datasets rather than in live production environments. Practical implementation would require integrating the recommended models, such as Random Forest, into active network intrusion detection systems or web application firewalls used in industrial settings.
AI-generated from the published abstract. Always read the original work before citing.
Cybersecurity attacks that target software have become profitable and popular targets for cybercriminals who consciously take advantage of web-based vulnerabilities and execute attacks that might jeopardize essential industry 5.0 features. Several machine learning-based techniques have been developed in the literature to identify these types of assaults. In contrast to single classifiers, ensemble methods have not been evaluated empirically. To the best of our knowledge, this work is the first empirical evaluation of both homogeneous and heterogeneous ensemble approaches compared to single classifiers for web-based attack detection in industry 5.0, utilizing two of the most realistic public web-based attack datasets. The authors divided the experiment into three main phases: In the first phase, they evaluated the performance of five well-established supervised machine learning (ML) classifiers. In the second phase, they constructed a heterogeneous ensemble of the three best-performing ML algorithms using max voting and stacking methods. In the third phase, they used four well-known homogeneous ensembles to evaluate the performance of the bagging and boosting method. The results based on the ECML/PKDD 2007 and CSIC HTTP 2010 datasets revealed that bagging, particularly Random Forest, outperformed single classifiers in terms of accuracy, precision, F-value, FPR, and area of the ROC curve with values of 99.597%, 98.274%, 99.129%, 0.523%, 100 and 99.867%, 99.867%, 99.867%, 0.267%, 100, respectively. In contrast, single classifiers performed better than boosting and stacking. However, in terms of FPR, the boosting exceeded single classifiers. Max voting is appropriate when accuracy, precision, and FPR are the primary concerns, whereas single classifiers can be employed when recall, FNR, training, and prediction times are critical elements. In terms of training time, ensemble approaches are more likely to be affected by data volume than single classifiers. The paper’s findings will help security researchers and practitioners identify the most efficient learning techniques for securing web applications.
This page summarises published work. The authoritative version sits with the publisher.
DOI: 10.1016/j.jksuci.2023.02.009
Is something wrong with this record? Report it or request removal.
Discussion
Have you built on this work, tried to replicate it, or seen it applied in practice? Share what you know. Verified researchers and MARATTO™ domain experts can open a discussion, and any member can reply. Contributions are reviewed before they appear.
No discussion yet. Open the first thread.
New to MARATTO™? Create a free account.
