Jul 2026· 2026 3rd World Conference on Computer and Information Security (WCCIS)· pp. 263-269· 0 citations· 13 references
Abstract
Traditional network traffic attack detection relies on manual feature engineering and struggles to effectively handle obfuscation variants such as URL encoding and case-mixing. This paper proposes a detection method based on the DeepSeek-R1-Distill-Qwen-14B large language model. In terms of paradigm, the 14B-parameter model is directly used as the detection engine, encoding HTTP request fields into semantic text sequences via a fixed template to replace statistical features. In terms of methodology, a reverse-weighted cross-entropy loss is designed -applying a $1.5 \times$ weight to the normal class, equivalent to shifting the decision boundary outward by 0.41 logit units to suppress false positives in production environments. On a dataset constructed by fusing CSIC 2010, HTTPParamsDataset, PayloadsAllTheThings, and proprietary POC data, the model achieves an F1 score of 0.9931 on 17,479 test samples, with a false positive rate of 0.07% (only 4 false alarms among 5,827 normal requests), approximately a $12 \times$ reduction compared with XGBoost (0.86%). The model employs 4-bit quantization, with only 13.58 million trainable parameters (0.0969% of 14B), enabling both training and deployment on a single consumer-grade GPU.
The proposed LLM-based framework offers a promising approach for improving phishing detection and strengthening modern cybersecurity defenses and suggests that transformer-based models can effectively identify deceptive domain structures, abnormal URL patterns, and obfuscation techniques.
L. Eliyan, M. Alshraideh, Bayan Alfayoumi· Journal of integrated scienc...· 0 citations
Cross-Site Scripting (XSS) attacks remain one of the most impactful attacks and a major threat to web applications, especially when malicious payloads are stuffed via email input. Although advanced learning solutions have achieved significant detection, their computational and time-consuming heuristics often prevent their deployment in resource-limited environments, such as shared hosting or edge sites. This paper presents a lightweight machine learning approach designed to instantly detect XSS attacks originating from web forms. The model is capable of operating independently without relying on external resources or systems (such as cloud services or large detection engines). The proposed solution focuses on a combined feature set consisting of fast-to-calculate syntactic and lexical indicators (such as tag count, suspicious token frequency, coding markup, and entropy). Simple and well-established classifiers—logistic regression, random forest, and LightGBM—were used, focusing on detection effectiveness (precision, recall, F1, and AUC) and operational constraints (inference time per sample and model size). To reflect real-world conditions, the experiments combine generic XSS payloads, benign sample templates, and synthetically modified payloads that mimic the obfuscation and encryption techniques used by attackers. The results are lightweight, low-effort, and highly accurate, and they compete with heavier competitors, with significantly lower semantic and memory footprint costs.
Dhurgham Kareem Gharkan, H. R. Mahmood, Ali Sadiq Salim· ITEGAM- Journal of Engineeri...· 0 citations
The rapid spread of AI-generated misinformation poses serious risks to public discourse and societal stability, creating an urgent need for automated fake text detection systems. This paper presents an authenticity detection framework that integrates transformer-based architectures (RoBERTa and BERT) with parameter-efficient fine-tuning strategies, specifically DoRA and LoRA, evaluated on the FakeNewsNet dataset. The proposed RoBERTa + DoRA model achieves 88.40% accuracy on FakeNewsNet while updating less than 1% of model parameters, outperforming full fine-tuning baselines and demonstrating superior computational efficiency. Ensemble strategies further boost performance, with a hard voting ensemble reaching 92.23% accuracy. Compared to resource-intensive large language models such as ChatGPT and GPT-4, the proposed approach delivers competitive results with significantly lower computational overhead, making it suitable for real-time deployment. These findings demonstrate that modern parameter-efficient methods, when combined with modular architectures, offer a scalable and adaptable solution for fake news detection across diverse domains.
A. Abdelhady· 2026 6th International Confe...· 0 citations
Signature-based Intrusion Detection Systems such as Snort are widely deployed due to their transparency, but their dependence on manually crafted rules creates persistent blind spots against attack categories not covered by existing signatures. This paper investigates whether machine learning can meaningfully improve Snort's detection capability without replacing its rule-based architecture. Using the CICIDS2017 dataset, we evaluated Snort 3 in three configurations: default built-in rules, community rules, and a hybrid configuration in which rules are derived from a flow level SD-RNN classifier trained on CICIDS2017 features. The SD-RNN model is independently re-implemented and trained in this work, achieving 97.14% overall accuracy with a macro recall of 0.93 across 15 attack classes. Our experiments show that Snort's built-in rules detect only 30.27% of attack flows overall, with complete failure on FTP-Patator, PortScan, Bot, SQL Injection, and Infiltration. The community rules provide negligible additional coverage. ML-derived rules raise the overall detection rate to 58.36%, covering 9 of 14 attack classes above 80% detection, including 100% detection for brute-force and web application attacks that signature-only configurations miss entirely. We present a complete evaluation methodology and a reproducible flow level framework for aligning Snort's packet-level alerts with flow level ground truth, which can serve as a baseline for future work on ML-enhanced signature-based IDS.
Shrinivas Khedkar, Deep Kasodariya, Aditya Yedurkar et al.· International Seminar on Int...· 0 citations
HTTP Flood attacks remain difficult to detect because they operate at the application layer, resemble legitimate user requests, and generate burst-based temporal traffic patterns. Previous DDoS detection studies often rely on outdated datasets, process network flows as independent records, insufficiently address class imbalance, and provide limited interpretability for security analysts. This study proposes a sequence-aware and explainable deep learning framework for HTTP Flood detection using Long Short-Term Memory (LSTM). Reconstructed HTTP traffic from the UNSW-NB15 dataset was processed through proxy labeling, data cleaning, feature normalization, and sliding-window transformation to convert flow-level records into temporal sequences. Class weighting and SMOTE oversampling were evaluated to mitigate imbalance, while SHAP and LIME were used to explain model decisions. The proposed LSTM model achieved an attack recall of 94.8%, a false negative rate of 5.2%, balanced accuracy of 94.3%, MCC of 0.824, and ROC-AUC of 0.975. The results show that temporal representation improves detection of bursty HTTP Flood behavior, whereas class weighting provides a better balance between attack sensitivity and false-alarm control. Explainability analysis further confirms that the model relies on technically meaningful indicators, including packet rate, flow duration, traffic asymmetry, and service concentration. This framework supports interpretable early-warning detection for application-layer DDoS attacks.
The next big jump will not be driven by larger parameters, but smaller, more visible and dynamic systems that can be trusted by security analysts, as well as a disconnect between lab and reality.
Hai-Yang Wang, Yuejin Zhang· Frontiers in Computing and I...· 0 citations
