TWO-LAYER WEB APPLICATION SECURITY MODEL BASED ON OWASP TOP 10:2025 AND ARTIFICIAL INTELLIGENCE METHODS

Abstract

Web applications continue to be the primary target for cyberattacks such as SQL injection (SQLi), cross-site scripting (XSS), cross-site request forgery (CSRF), and distributed denial-of-service (DDoS). The traditional methods of defense - signature matching, static rule sets, and perimeter control - can no longer keep up with the dynamic threats that modern cloud-based and API-driven systems face on a daily basis. In this paper, we propose a two-layer security model framework designed to bridge this gap. The framework is organized into two complementary layers. The first layer uses deterministic security controls aligned with the OWASP Top 10:2025 standard, providing a stable and auditable baseline of protection. The second layer integrates three complementary AI techniques: HTTP request embeddings (HTTP2vec) for semantic representation of traffic, Graph Neural Networks (GNNs) for modeling relational patterns between users, sessions, and endpoints, and an autoencoder-based online anomaly detector called Kitsune, which adapts to evolving traffic in real time. We use a structured analytical approach in this study. First, we review recent research papers and real-world incident reports from industry, and then we systematically compare different detection methods across accuracy, latency, and operational cost. The results show that traditional controls remain effective against known attack signatures, while AI-driven methods are far better at uncovering zero-day exploits and coordinated, low-and-slow campaigns that rule-based systems typically miss. Industry reports indicate that integrating AI into SIEM and SOAR platforms can reduce false-positive alerts by approximately 60% and accelerate incident investigation by about 40%, freeing analysts to focus on higher-value tasks. We also argue that Precision–Recall curves and the Numenta Anomaly Benchmark (NAB) are more appropriate evaluation tools than ROC-AUC for security data, where malicious traffic often represents less than 0.1% of total volume and class imbalance distorts conventional metrics. The main conclusion is simple but important: AI performs best not as a replacement for traditional controls, but as a force multiplier that strengthens them, producing a layered defense that is both resilient and adaptive.