WADBERT: Dual-channel Web Attack Detection Based on BERT Models

TL;DR

WADBERT tackles web attack detection by addressing irregular and symbol-dense HTTP requests, unordered payload parameters, and the need for attack traceability. It introduces Hybrid Granularity Embedding to fuse character-level and subword information, uses dual encoders URLBERT and SecBERT to extract URL and payload semantics, and applies a multi-head attention mechanism to model unordered parameter relationships and locate malicious parameters. Empirical results on CSIC2010 and SRBH2020 show state-of-the-art accuracy (up to 99.70%) and strong F1-scores, with ablation and interpretability analyses confirming the contribution of each component. The approach offers robust detection and actionable parameter-level insights, making it highly applicable to real-world web application firewall scenarios.

Abstract

Web attack detection is the first line of defense for securing web applications, designed to preemptively identify malicious activities. Deep learning-based approaches are increasingly popular for their advantages: automatically learning complex patterns and extracting semantic features from HTTP requests to achieve superior detection performance. However, existing methods are less effective in embedding irregular HTTP requests, even failing to model unordered parameters and achieve attack traceability. In this paper, we propose an effective web attack detection model, named WADBERT. It achieves high detection accuracy while enabling the precise identification of malicious parameters. To this end, we first employ Hybrid Granularity Embedding (HGE) to generate fine-grained embeddings for URL and payload parameters. Then, URLBERT and SecBERT are respectively utilized to extract their semantic features. Further, parameter-level features (extracted by SecBERT) are fused through a multi-head attention mechanism, resulting in a comprehensive payload feature. Finally, by feeding the concatenated URL and payload features into a linear classifier, a final detection result is obtained. The experimental results on CSIC2010 and SR-BH2020 datasets validate the efficacy of WADBERT, which respectively achieves F1-scores of 99.63% and 99.50%, and significantly outperforms state-of-the-art methods.

Figures (8)

• Figure 1: Components of an HTTP request. The URL is extracted from the request line, excluding the query string. The request body, query string and request header form a set of key-value pairs, known as the payload parameters.
• Figure 2: Framework of the proposed model.
• Figure 3: Framework of the HGE.
• Figure 4: Loss curves during the training process.
• Figure 5: Performance comparison of different embeddings method.