Scholarlink

<p>Anomaly detection in HTTP traffic is critical for securing web applications against evolving cyber threats. We propose a semi-supervised method that combines domain-specific language modeling with sequence reconstruction to identify anomalies in HTTP requests. Our approach leverages only benign traffic for training and uses reconstruction errors for detecting malicious activity. It achieves a strong balance between precision and recall while maintaining low computational requirements, making it suitable for real-time and edge deployments. Extensive evaluations on three public HTTP datasets show that our method outperforms traditional baselines and fine-tuned BERT models, with an F1-score of 0.92 and AUC of 0.96. We also introduce a simple interpretability mechanism by attributing anomalies to token-level reconstruction errors, providing insights into detected threats. The proposed solution is scalable, lightweight, and effective across diverse attack scenarios without requiring large labeled datasets.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Semi-supervised method for anomaly detection in HTTP traffic

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年8月21日

查看全文
  • Malki Ishara Wasundara,
  • Junwei Zhou,
  • Yanchao Yang,
  • Dongdong Zhao,
  • Jianwen Xiang

摘要

Anomaly detection in HTTP traffic is critical for securing web applications against evolving cyber threats. We propose a semi-supervised method that combines domain-specific language modeling with sequence reconstruction to identify anomalies in HTTP requests. Our approach leverages only benign traffic for training and uses reconstruction errors for detecting malicious activity. It achieves a strong balance between precision and recall while maintaining low computational requirements, making it suitable for real-time and edge deployments. Extensive evaluations on three public HTTP datasets show that our method outperforms traditional baselines and fine-tuned BERT models, with an F1-score of 0.92 and AUC of 0.96. We also introduce a simple interpretability mechanism by attributing anomalies to token-level reconstruction errors, providing insights into detected threats. The proposed solution is scalable, lightweight, and effective across diverse attack scenarios without requiring large labeled datasets.