This work proposes an injection attack detection framework, TDNET, that combines dual-channel feature extraction, multidimensional feature fusion, adaptive attention refinement, and time-sensitive neural architecture search optimization.
Abstract
Web injection attacks continue to threaten critical infrastructures in power network environments because traditional Web Application Firewalls show limited adaptability when attack payloads become obfuscated or structurally modified. Existing detection approaches also face challenges from heterogeneous payload structures and the trade-off between detection accuracy and inference efficiency under high-concurrency environments. We thus propose an injection attack detection framework, TDNET, that combines dual-channel feature extraction, multidimensional feature fusion, adaptive attention refinement, and time-sensitive neural architecture search optimization. Unlike prior work that adopts off-the-shelf components, each module in TDNET is specifically adapted for the injection detection task: the character channel captures fine-grained structural perturbations, the subword channel preserves semantic token relationships, and a cross-layer fusion mechanism retains hierarchical representations from all encoder depths. Experiments on public datasets and generated attack samples containing SQL injection, XSS, and RCE payloads demonstrate that TDNET achieves an F1-score of 98.13%, which exceeds the compared baselines by an average of 3.94%. Ablation studies confirm that the dual-channel design provides complementary gains over single-channel variants, and the FPD-searched architecture reduces normalized inference time to 65.47% while maintaining detection performance close to the full architecture.
ABSTRACT - Modern web applications face an unprecedented surge in sophisticated cyber threats, including SQL injection, cross-site scripting (XSS), remote code execution, and credential stuffing attacks. Traditional rule-based Web Application Firewalls fail to detect zero-day exploits and context-dependent attack patterns due to their static, signature-driven nature. This paper proposes an intelligent, transformer-based end-to-end Web Application Firewall (WAF) pipeline that leverages the self-attention mechanism of transformer architectures to capture long-range dependencies within HTTP request sequences. The proposed system ingests raw HTTP traffic, performs tokenization and feature extraction, and feeds the encoded representation into a fine-tuned BERT variant for binary and multi-class threat classification. The pipeline integrates preprocessing, model inference, and response action modules into a unified deployment-ready architecture. Experimental evaluation on benchmark intrusion datasets including CSIC 2010 and HTTPD-DS demonstrates that the proposed transformer WAF achieves 97.8% detection accuracy, 96.4% F1-score, and sub-10ms inference latency, outperforming conventional machine learning and CNN-based approaches. This work establishes transformer models as a practical and deployable foundation for next-generation WAF systems.
Keywords — Web Application Firewall, Transformer, BERT, HTTP Traffic Analysis, Intrusion Detection, Deep Learning, Cybersecurity, NLP
Muralidharan V, G. S, . A. J. A· International Scientific Jou...· 0 citations
The proposed machine learning-based system for detecting and mitigating SQL injection attacks is designed not just to protect against conventional SQLi attacks but also against JSON-based SQLi attacks, NoSQL injection attacks, hybrid attacks, and conventional WAF evasion techniques.
Nisha P. Shetty, Vinayak Kothari, Eva Hemantkumar Shah et al.· Journal of Mobile Multimedia· 0 citations
Traditional signature-based Web Application Firewalls (WAFs) have difficulty detecting increasingly complex assaults that target web applications, such as SQL injections, Cross-Site Scripting (XSS), and API misuse. In this study, we introduce LLM-WAF, a new intelligent firewall architecture that uses Large Language Models (LLMs) to analyze HTTP traffic contextually and semantically. Our framework integrates pre-trained language models with realtime traffic monitoring pipelines to identify malicious payloads through natural language processing capabilities rather than static rule matching. The system incorporates a continuous learning mechanism using reinforcement signals from detected attacks to adapt to emerging threat vectors automatically. In comparison to conventional WAF systems, experimental evaluation on benchmark datasets such as the CSIC 2010 HTTP Dataset and real-world traffic scenarios shows that LLM-WAF achieves 96.8% detection accuracy with an F1=0.95cand dramatically lowers false positives.
Y. Khalaf· International Journal of Wir...· 0 citations
A privacy-preserving intrusion detection framework that operates exclusively on flow-level traffic metadata without deep packet inspection, which supports the practicality of explainable Transformer models for secure and scalable APT detection in encrypted 5G environments.
An explainable deep learning framework evaluated across multiple heterogeneous cyber attack datasets, including Kitsune, Server-Based network data,enterprise logs, and Malware Traffic datasets, demonstrating the effectiveness of the proposed framework in handling heterogeneous network traffic while providing interpretable insights into model predictions.
Large language models (LLMs) embedded in enterprise workflows cannot structurally distinguish legitimate instructions from adversarial ones in the same token stream, making prompt injection OWASP's top LLM risk for two consecutive editions a persistent threat across direct and indirect vectors. This paper presents PromptShield-RT, a layered, real-time, model-agnostic framework combining input normalization and provenance tagging, lexical-heuristic pattern matching, a statistical classifier, structural anomaly features, and calibrated risk fusion, with policy-driven mitigation (allow/sanitize/quarantine/block) and an explainable, adaptive-feedback mechanism for SOC workflows. We construct an original evaluation corpus, SynPI-Bench (n = 450, six categories), and a template-disjoint held-out generalization set (n = 31) with novel phrasings, obfuscation encodings, and adversarial hard-negative benign text. Using template-grouped 5-fold cross-validation, the fused pipeline achieves 92.4% accuracy (F1 = 0.930, AUC = 0.990), outperforming heuristic-only (57.0%) and naive-averaged (59.2%) baselines, while a lexical classifier reaches 85.9% with lower precision. We report a pronounced generalization gap on the held-out set (48.4% accuracy, 90% false-positive rate on hard negatives), quantifying a known limitation of surface-lexical defenses. The pipeline achieves sub-millisecond P95 latency (0.266 ms), within typical 50 ms enterprise SLAs. We situate PromptShield-RT relative to structural, architectural, and guardrail-product defenses, arguing for layered, defense-in-depth architectures, with reproducible code provided.
Fatimah Alhamzawi· Al-Noor Journal of Engineeri...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
