A Real Evasion Attack Against a Trained Classifier

A complete, runnable web application firewall classifier trained on real SQLi/XSS and benign query strings, then evaded by finding and exploiting the single character n-gram the model learned to associate most strongly with benign, dropping its malicious score from 0.9594 to 0.2836.

~5 min total·4 quadrants of structured content

By the end of this topic, you will

Train a character n-gram TF-IDF plus logistic regression web application firewall classifier
Find the single n-gram a trained model has learned to associate most strongly with benign, and explain why that reveals a learned bias
Explain why the evaded payload still executes exactly as written even though the classifier's verdict flipped

Quadrant 1 · e-Tutorial

Video lectures and walkthroughs

Video content coming soon.

Quadrant 2 · e-Content

Articles and case studies

A Real Evasion Attack Against a Trained Classifier

Reading about evasion is one thing; running one against a classifier you trained yourself is another. Appending 150 copies of a single, functionally meaningless character flips this real classifier's verdict from malicious to benign.

Quadrant 3 · Web Resources