Detecting Intrusions in MongoDB NoSQL Databases Using Machine Learning

Abstract

Due to their flexibility and scalability, NoSQL databases, most notably MongoDB, are widely adopted in the modern cloud environment. However, this popularity introduces new security vulnerabilities, such as NoSQL injections, brute-force attacks, and denial-of-service attacks, which traditional Intrusion Detection Systems (IDS) struggle to detect. In this paper, machine learning is adapted to detect five types of attacks targeting MongoDB including NoSQL injections, XSS through the $where operator, brute-force attacks, denial-of-service attacks through expensive queries, and preparatory scanning. For this purpose, the ToN_IoT dataset is adapted to the MongoDB context by selecting 150,000 representative samples and 9 native features, and implementing four composite features. Three models are evaluated: Random Forest, XGBoost, and MLP Classifier. XGBoost achieves the best performance with an inference time of 0.019 ms, an accuracy of 98.9% and a macro F1-score of 0.9889. Performance per class indicates that scanning attacks and brute-force attacks are the easiest to detect (F1 > 0.98). However, injection attacks and XSS attacks are more difficult to detect (F1 < 0.98) due to their signatures associated with the application level, which are difficult to detect. The present method outperforms previous methods reporting 96-98% accuracy while offering MongoDB specificity and interpretability. These experiments reveal that real-time detection of attacks on MongoDB is achievable with high efficiency, allowing it to be deployed in cloud environments.