Detection of web attacks via HTTP requests using NLP techniques

Abstract

The work focuses on improving web attack detection methods through the analysis of HTTP traffic using natural language processing (NLP) techniques and transformer-based models, particularly BERT. The relevance of research in the field of web attack detection is underscored by the significant achievements of the model trained on an extended dataset containing 195,000 records. The developed model based on BERT demonstrates high efficiency in detecting web attacks due to its deep contextual understanding and modern Word Piece tokenizer, which better handles rare words. Unlike methods such as Doc2Vec, LSTM-CNN, or Isolation Forest, our model accounts for global word relationships enhancing its accuracy.

Some previous studies have limitations; notably, some do not utilize state-of-the-art architectures, which limits their ability to achieve high model accuracy. Additionally, while using modern architectures, other studies operate with small datasets, limiting their capability to effectively detect various attack types and ensure high detection quality. In the context of these challenges, the created model was trained on an extended dataset, resulting in significantly better performance compared to leading analogs in the field of web attack detection. The high balanced accuracy of the model at 0.9998 confirms its effectiveness and reliability, making it a potentially important tool for cyber security applications.