Deep Learning in NLP for Anomalous HTTP Requests Detection

Techniques for Deep Learning (DL) and Natural Language Processing (NLP) are rapidly advancing. In addition, we notice that the access and utilisation of web applications is expanding in almost all fields in conjunction with related technologies. Web applications include a wide range of use cases involving personal, financial, military, and political data. This renders web-based applications a desirable target for cyber-attacks. To address this problem, we propose, in this study, a novel model capable of differentiating normal HTTP requests from different types of anomalous HTTP requests. Our model combines NLP techniques, the Bidirectional Encoder Representations from Transformers (BERT) model, and DL techniques. The pre-trained BERT model is able to operate on unprocessed data and therefore does not require manually extracted features. Our experimental results show that the proposed method achieves an F1 score of more than 98.90% in the classification of multiple categories of anomalous requests and normal requests on CAPEC dataset. Furthermore, we leverage Transfer Learning in order to detect new types of anomalous requests or new attack patterns that are similar to training anomalous patterns. With Transfer Learning techniques, our proposed model achieves an F1-score of 61.50% on unseen types of anomalous HTTP requests.