ML-WAF information technology for classification and blocking of injection attacks in a containerized Web environment

Abstract

This paper presents an adaptive ML-based Web Application Firewall (ML-WAF) designed for the classification and blocking of injection attacks in containerized web environments. The relevance of this work is driven by the widespread adoption of micro-services, container orchestration, and Kubernetes, which significantly reshapes the requirements for securing HTTP(S) traffic. Traditional signature-based WAF solutions exhibit limited effectiveness against SQL Injection, Cross-Site Scripting, and Command Injection due to their variability, contextual dependence, and susceptibility to evasion techniques. The aim of the study is to develop and experimentally evaluate a ML-oriented web-filtering technology that provides high-accuracy detection of malicious HTTP(S) requests, low processing latency, and continuous model self-updating within an MLOps pipeline. To achieve this goal, the paper introduces conceptual, structural, functional, and information-logical models of the ML-WAF, along with UML representations (Use Case, Activity, Class, Sequence) that formalize the architecture, behaviour, and interactions between system components. The proposed technology incorporates a multi-stage processing pipeline, including TF/IDF vectorization with enriched features, a KNN classifier, a risk-based decision engine (ALLOW/SANDBOX/BLOCK), monitoring and logging subsystems, and automated model retraining. A hybrid method of integrating the ML component into a WAF in Kubernetes is proposed, combining an Ingress Controller, a dedicated ML-service, and a Horizontal Pod Autoscaler. This approach ensures high scalability and stable performance under varying workloads. The practical evaluation was conducted in a Kubernetes-based containerized environment using realistic SQLi and XSS datasets and load testing with Apache JMeter. Experimental results demonstrate that the ML-WAF achieves a Precision of 0.95, Recall of 0.93, and an F₁-score of 0.94, with an average processing latency of 3.9 ms and a throughput of approximately 700 requests per second. The system reduced false positives to 2.3%, compared to 6.8% for ModSecurity, while scaling the ML-WAF to six Pods increased throughput by 27% without degrading classification quality. The presented results confirm that the proposed ML-WAF technology forms a robust foundation for next-generation AI-driven security gateways in cloud-native and containerized infrastructures.