MLAB-BiLSTM: Online Web Attack Detection Via Attention-Based Deep Neural Networks

Abstract

With the continuous development of Web threats such as SQL injection and Cross-Site Scripting, Numerous web applications have been plagued by various forms of security threats and cyber attacks. And web attack detection has always been the focus of web security. Because the attacking payloads are often multiple small segments hidden in the long original request traffics, traditional machine learning based methods may have difficulties in learning useful patterns from the original request. In this study, we proposed an MLAB-BiLSTM method that can precisely detect Web attacks in real time by using multi-layer attention based bidirectional LSTM deep neural network. Firstly, due to the malicious payloads contains similar keywords, we used a keyword enhanced embedding method to transfer the original request to feature vectors. Then the features are divided into different segments. The words in the segments are firstly inputted into the bidirectional LSTM model with an attention mechanism to generate a encoded representation of different segments. Then the segments of the requests are input into another BiLSTM model with an attention mechanism to generate the encoded representation of the original request. Finally, the generated features are input into the Convolutional Neural Network to find out which kind of attack payload it is. The MLAB-BiLSTM model was tested on CSIC dataset and CTF competition traffic, the experiment results show that the accuracy of the model is above 99.81%, the recall of 99.56%, the precision of 99.60%, and the F1 Score is 0.9961, which outperformed both traditional rule-based methods like Libinjection or deep learning based methods like OwlEye.