AI-POWERED SYSTEM FOR NETWORK ACTIVITY MONITORING AND DETECTION OF SQL INJECTION ATTACKS USING ZABBIX AND GRAFANA

Abstract

Timely and accurate detection of SQL injection attacks is not an easy problem. It is essentially an online pattern matching task, requiring constant monitoring of huge volumes of network traffic and fast inferences about tiny anomalies. To automate the burden of this task, we design and implement an intelligent monitoring system that combinatorially leverages Zabbix for data ingestion, Grafana for visual interactive analysis, and machine learning models for activity classification. The system architecture continuously pulls raw network flows through Zabbix agents at strategic ingress and egress points. Collected metrics (HTTP request patterns, query payload entropy, anomalous response latency, etc.) are then passed to an optional pre-processing module, which applies feature engineering and dimensionality reduction.

The ensemble of a gradient-boosted decision tree and recurrent neural network then assigns a real-time probabilistic SQL-injection risk score to each session. Events with a score above a pre-set threshold are simultaneously logged to Zabbix, plotted on Grafana dashboards, and routed for action to security orchestration playbooks. The closed feedback loop greatly reduces mean time to detection (MTTD) and mean time to response (MTTR) so that high-risk events are actively responded to by security analysts while benign noise is automatically filtered out.

Experimental validation on a 5.2 million HTTP transaction labeled dataset reports 97.3 % recall and 1.8 % false positives, improving over the signature-based baseline monitors by more than 12 percentage points on F1-score. Production-quality deployment tests also verify zero-overhead (<2 % CPU, <50 MB RAM) on the hosts monitored. The proposed system thus provides an efficient, scalable, and adaptive solution to protect enterprises against SQL-injection attacks with AI-based monitoring.