Web application attack detection based on a combination of transformers, convolutional neural network, and multilayer perceptron

Abstract

Given the steady increase in the number of attacks on web applications, the task of automatically detecting such attacks requests remains one of the key challenges in information security. The aim of this work is to develop a new hybrid approach to detecting attacks on web applications in which the feature extraction stage is shifted to the level of pretrained transformers. To achieve this goal, the paper proposes a hybrid method for detecting attacks on web applications based on the combined use of specialized transformer models and neural networks of various architectures. The suggested approach offers that the request URL is processed by a URLBERT model trained on the structural features of web addresses, while the request content is analyzed by a SecRoBERT model tailored for cybersecurity tasks. The resulting contextual representations are combined and fed into parallel blocks of a convolutional neural network and a multilayer perceptron, which extract local and global features, respectively. The proposed approach combines the capabilities of transformer data processing models with the efficient identification of statistical and local dependencies based on a convolutional neural network and a multilayer perceptron, which improves the accuracy of malicious query classification. Experimental evaluation is conducted on three datasets, two of which are used for binary classification and one for multi-class classification. Testing was performed using k-fold cross-validation and by measuring the model output latency to demonstrate the method applicability in real-time attack detection systems. The results of the experimental evaluation of the proposed model demonstrate high accuracy in detecting attacks on web applications, but also reveal a significant drawback related to the considerable time required to process requests. Analysis of the test results and comparison with relevant studies confirm the feasibility of using this model as the second stage of request analysis in web application attack detection systems.