A novel hybrid neural network approach incorporating convolution and LSTM with a self-attention mechanism for web attack detection

As web attacks have recently increased in number and sophistication, traditional machine learning methods have struggled to defend against well-designed attacks. Therefore, deep learning methods have been widely used in web attack detection, leveraging their ability to discern intricate features within the original payload for precise identification of web application threats. In this study, we propose a novel hybrid neural network model for web attack detection, named hybrid convolutional long short-term memory (HCLSTM). Specifically, the HCLSTM model utilizes two branches to extract features from Hypertext Transfer Protocol (HTTP) request packet: a Deep Feedforward Neural Network (DFNN) branch for extracting word features from Uniform Resource Locator (URL), and a Convolutional Neural Network (CNN) branch for capturing combinatorial and local relationships within payloads. Then, the extracted features from both branches are concatenated and subsequently fed into a Bidirectional Long Short-Term Memory (Bi-LSTM) network integrated with a self-attention mechanism, designed to capture intricate link relationships between URL and payloads. The final classification layer produces the detection results. To evaluate the proposed model, we conducted experiments on CSIC 2010 HTTP dataset. The experimental results reveal that HCLSTM can accurately detect web attacks with a high accuracy of 99.46% and a low false positive rate of 0.02%.