Deployment-Aware Evaluation of a Machine Learning-Based Web Application Firewall for Academic E-Voting Systems

Abstract

Web applications in higher education, including e-voting systems for student-organization elections, are frequent targets of SQL Injection (SQLi) and Cross-Site Scripting (XSS) attacks. Machine Learning (ML) based Web Application Firewall (WAF) studies usually select models by offline accuracy on curated datasets, which says little about how a model behaves once it filters live requests. This study aims to build an ML-based WAF embedded as middleware in an academic e-voting application and to test whether offline accuracy is a sufficient criterion for selecting a deployable model. HTTP request payloads were vectorized with character-level TF-IDF n-grams and Chi-Square feature selection, and Decision Tree (DT) and Random Forest classifiers were integrated into a Flask-based WAF that performs allow, block, and log actions. The models were assessed with a three-layer deployment-aware protocol: offline hold-out evaluation, black-box testing of the integrated middleware, and an independent stress test of 500 requests containing obfuscated attacks and look-alike benign inputs. Offline, the two models differed by less than 0.3 percentage points, with Random Forest reaching 99.54% accuracy for SQLi and 100% for XSS. Under the stress test, however, DT missed four obfuscated SQLi payloads, whereas Random Forest blocked all 400 attacks with 99.2% overall accuracy and a mean inference latency of 5.5 ms. Offline accuracy therefore hid a security-relevant difference that only deployment-aware testing revealed. The protocol and the security-first selection criterion offer a practical basis for evaluating ML-based WAFs in institutional web applications.