A Hybrid Passive–Active Framework for Server-Side Request Forgery Detection Using Machine Learning

Server-Side Request Forgery (SSRF) lets an attacker coerce a server into issuing requests to attacker-chosen destinations, exposing internal services and cloud metadata. We present ML-SSRFinder, a dual-mode framework that unifies three analysers. In passive mode, before any traffic is sent, a deterministic rule-based calculator scores the request with fourteen weighted features and a supervised XGBoost classifier provides a triage prior. In active mode, after injection, a supervised response model classifies the HTTP response on thirty-three features, the strongest of a support vector machine, XGBoost, and a random forest giving the verdict by default and their majority-vote ensemble remaining available as an option; a deterministic content-analysis module adds high-precision matching for cloud metadata, credentials, system files, and firewall blocks, and a mode-dependent formula fuses the signals. We report only metrics produced by the training code. On the forty-example request corpus the passive classifier attains a leave-one-out accuracy of 0.900 (F1 0.933); on the twenty-eight-example response corpus the leave-one-out accuracies are 0.857 for the support vector machine, 0.679 for the random forest, and 0.643 for XGBoost, the support vector machine ranking first and adopted as the default response model. No component is perfect; the passive classifier is a triage signal rather than a verdict, and the small corpora make all estimates indicative rather than definitive.