Development of a Hybrid LSTM and Isolation Forest Architecture for Realtime SQLi, Brute-Force, and Data Exfiltration Attack Detection on MariaDB - Khusnul Khotimah; Hartono; Rama Apriando; Faris (LPPM Universitas Muhammadiyah Kotabumi, 2026)
This research is in the field of cybersecurity and artificial intelligence, focusing on developing a real-time attack detection system for MariaDB databases. The research was motivated by the increasing threats of SQL injection (SQLi), brute-force attacks, and data exfiltration, which are increasingly difficult to detect using conventional rule-based methods. The objective of the research was to develop a hybrid architecture based on Long Short-Term Memory (LSTM) and Isolation Forest to improve detection accuracy while reducing false positives in modern database environments. The research method employed a Research and Development (R&D) approach through three main modules. The first module applies a bidirectional LSTM to detect SQLi based on query sequence analysis. The second module uses Isolation Forest and Rotated Isolation Forest to detect brute-force attacks through access behavior analysis. The third module applies Isolation Forest to detect data exfiltration based on traffic patterns and data transfer behavior. The entire dataset underwent preprocessing, feature engineering, tokenization, normalization, and performance evaluation using confusion matrices, precision, recall, F1-score, and AUC. The results show that the Bi-LSTM model achieved 99.99% accuracy in detecting SQLi. In brute-force detection, the standard Isolation Forest provided the best performance with a recall of 99.94% and an F1-score of 99.61%. Meanwhile, the data exfiltration module achieved a 100% detection rate on simulated exfiltration traffic with a combined accuracy of 94.92%. This study proves that the hybrid LSTM–Isolation Forest architecture is capable of providing accurate, adaptive detection and is feasible to be implemented as a next-generation MariaDB database security system.