静态嵌入模型在HTTP请求异常检测中的比较评估

中文摘要 AI 辅助

Web应用程序日益受到利用HTTP请求规避安全机制的网络攻击的威胁。传统的Web应用防火墙（WAF）依赖于基于规则的方法，这些方法通常表现出较高的误报率和有限的适应性。最近的研究探索了机器学习技术和词嵌入模型，以改进HTTP流量中的异常检测。本文提出了一个静态嵌入模型（具体为Word2Vec、FastText和Doc2Vec）在统一单类分类框架下的基准测试。我们提出了HEDA（基于HTTP嵌入的检测架构），一种模块化检测流水线，将静态嵌入表示与单类异常检测模型相结合，以在请求级别检测异常。该方法在无监督环境中运行，其中嵌入模型和检测器均仅在良性HTTP流量上进行训练。所提出的方法在三个具有异构特征的数据集上进行了评估，包括合成流量和真实流量。实验结果表明，嵌入表示的选择显著影响检测性能，且基于FastText的嵌入在所有数据集上产生最一致的结果，实现了高检测率，同时将误报率控制在可接受范围内。

英文摘要

Web applications are increasingly targeted by cyberattacks that exploit HTTP requests to evade security mechanisms. Traditional web application firewalls (WAFs) rely on rule-based approaches that often exhibit high false positive rates and limited adaptability. Recent studies have explored machine learning techniques and word embedding models to improve anomaly detection in HTTP traffic. This paper presents a benchmark for static embedding models, specifically Word2Vec, FastText, and Doc2Vec, within a unified, single-class classification framework. We propose HEDA (HTTP Embedding-Based Detection Architecture), a modular detection pipeline that combines static embedding representations with single-class anomaly detection models to detect anomalies at the request level. The approach operates in an unsupervised environment, where both the embedding models and detectors are trained exclusively on benign HTTP traffic. The proposed methodology is evaluated on three datasets with heterogeneous characteristics, including both synthetic and real traffic. The experimental results show that the choice of embedding representation significantly affects detection performance, and that FastText-based embeds produce the most consistent results across all datasets, achieving high detection rates while keeping false positive rates under control.

发表机构

• Tilsor SA（蒂尔索尔公司）
• Facultad de Ingeniería, Universidad de la República（共和国大学工程学院）
• Universidad Católica del Uruguay（乌拉圭天主教大学）

机构由 AI 辅助整理，请以论文原文为准。