HTTP Anomaly Detection Using Character-Level 3-Gram TF-IDF and Hybrid TF-IDF–Hashing Representations: A Comparative Study of Machine Learning Models

Abstract

Web applications are frequent targets of cyberattacks such as SQL injection, cross-site scripting, and command injection, creating a need for accurate and computationally efficient anomaly detection systems. While recent approaches increasingly rely on deep learning and transformer-based architectures, these methods often require substantial computational resources and deployment complexity. This study presents a comparative evaluation of character-level feature representations and machine learning models for HTTP anomaly detection. Two feature encoding strategies, namely character-level 3-gram TF-IDF and hybrid TF-IDF–hashing representations, are investigated using Random Forest, LightGBM, multilayer perceptron (MLP), and fusion-based classifiers on the CSIC 2010 benchmark dataset. All models are trained and evaluated under consistent experimental settings to enable a fair comparison of feature representations and classification approaches. Experimental results show that the hybrid TF-IDF–hashing representation combined with LightGBM achieves the best performance, attaining 99.60% accuracy, precision, recall, and F1-score, outperforming all other evaluated models. Furthermore, comparisons with recently reported deep learning and transformer-based approaches indicate that lightweight machine learning methods can achieve competitive or superior performance while maintaining lower computational complexity and deployment overhead. The findings provide practical insights into the trade-offs between feature representations and classification models for HTTP anomaly detection.