Deep Learning in NLP for Anomalous HTTP Requests Detection
Open accessAbstract
Techniques for Deep Learning (DL) and Natural Language Processing (NLP) are rapidly advancing. In addition, we notice that the access and utilisation of web applications is expanding in almost all fields in conjunction with related technologies. Web applications include a wide range of use cases involving personal, financial, military, and political data. This renders web-based applications a desirable target for cyber-attacks. To address this problem, we propose, in this study, a novel model capable of differentiating normal HTTP requests from different types of anomalous HTTP requests. Our model combines NLP techniques, the Bidirectional Encoder Representations from Transformers (BERT) model, and DL techniques. The pre-trained BERT model is able to operate on unprocessed data and therefore does not require manually extracted features. Our experimental results show that the proposed method achieves an F1 score of more than 98.90% in the classification of multiple categories of anomalous requests and normal requests on CAPEC dataset. Furthermore, we leverage Transfer Learning in order to detect new types of anomalous requests or new attack patterns that are similar to training anomalous patterns. With Transfer Learning techniques, our proposed model achieves an F1-score of 61.50% on unseen types of anomalous HTTP requests.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Nguyen et al. (2023) developed a model combining NLP, BERT, and deep learning to differentiate normal HTTP requests from abnormal ones, with an F1 score over 98.90%.
“Nguyen et al. (2023) [48] developed a model combining NLP, the BERT model, and deep learning to differentiate normal HTTP requests from abnormal ones, as demonstrated experimentally by an F1 score of over 98.90% in the categorization of various types of unusual requests.”
From A systematic review on insider threat detection using natural language processing (2025) · cites this paper as [48]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2019) · Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) · doi:10.18653/v1/n19-1423 · Cited by 48,293 · see citing works
Domain-Adversarial Training of Neural Networks
Ganin, Y., Ustinova, E., Ajakan, H., Germain, P., Larochelle, H., Laviolette, F., Marchand, M., & Lempitsky, V. (2017) · Advances in Computer Vision and Pattern Recognition · doi:10.1007/978-3-319-58347-1_10 · Cited by 8,318 · see citing works
Adversarial Discriminative Domain Adaptation
Tzeng, E., Hoffman, J., Saenko, K., & Darrell, T. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.316 · Cited by 5,154 · see citing works
Contrastive Adaptation Network for Unsupervised Domain Adaptation
Kang, G., Jiang, L., Yang, Y., & Hauptmann, A. G. (2019) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2019.00503 · Cited by 994 · see citing works
A survey of unsupervised deep domain adaptation
Wilson, G., & Cook, D. J. (2020) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3400066 · Cited by 987 · see citing works
Beyond Sharing Weights for Deep Domain Adaptation
Rozantsev, A., Salzmann, M., & Fua, P. (2018) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2018.2814042 · Cited by 466 · see citing works
A Distributed Deep Learning System for Web Attack Detection on Edge Devices
Tian, Z., Luo, C., Qiu, J., Du, X., & Guizani, M. (2019) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2019.2938778 · Cited by 371 · see citing works
Deep Unsupervised Domain Adaptation: A Review of Recent Advances and Perspectives
Liu, X., Yoo, C., Xing, F., Oh, H., Fakhri, G. E., Kang, J., & Woo, J. (2022) · APSIPA Transactions on Signal and Information Processing · doi:10.1561/116.00000192 · Cited by 303 · see citing works
SecureBERT: A Domain-Specific Language Model for Cybersecurity
Aghaei, E., Niu, X., Shadid, W., & Al-Shaer, E. (2023) · Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-25538-0_3 · Cited by 210 · see citing works
Security and Privacy in Cloud Computing: Technical Review
Abdulsalam, Y. S., & Hedabou, M. (2021) · Future Internet · doi:10.3390/fi14010011 · Cited by 197 · see citing works
Naseem, U., Razzak, I., Khan, S. K., & Prasad, M. (2021) · ACM Transactions on Asian and Low-Resource Language Information Processing · doi:10.1145/3434237 · Cited by 194 · see citing works
Rehman, A. U., Kashif, M. I., Jhaveri, R. H., Raut, R., Saba, T., & Bahaj, S. A. (2022) · Security and Communication Networks · doi:10.1155/2022/4016073 · Cited by 175 · see citing works
A novel architecture for web-based attack detection using convolutional neural network
Tekerek, A. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102096 · Cited by 120 · see citing works
SQL Injection Attack Detection and Prevention Techniques Using Deep Learning
Chen, D., Yan, Q., Wu, C., & Zhao, J. (2021) · Journal of Physics Conference Series · doi:10.1088/1742-6596/1757/1/012055 · Cited by 83 · see citing works
Salih, A. A., Zeebaree, S. T., Ameen, S. Y., Alkhyyat, A., & Shukur, H. M. (2021) · International Engineering Conference on Sustainable Technology and Development (IEC) · doi:10.1109/iec52205.2021.9476132 · Cited by 78 · see citing works
A new multi-label dataset for Web attacks CAPEC classification using machine learning techniques
Riera, T. S., Higuera, J. R. B., Higuera, J. B., Martínez-Herráiz, J.-J., & Montalvo, J. A. S. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102788 · Cited by 53 · see citing works
Detecting Attacks on Web Applications using Autoencoder
Mac, H., Truong, D., Nguyen, L., Nguyen, H. N., Tran, H. A., & Tran, D. M. (2018) · International Symposium on Information and Communication Technology · doi:10.1145/3287921.3287946 · Cited by 43 · see citing works
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2018) · arXiv · doi:10.48550/arxiv.1810.04805
Flagged first, then by citations
Research works printed but not linked: 1
- Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in neural information processing systems, pages 2672-2680, 2014.
Cited by
Sorted by citations
Zero Trust: Deep Learning and NLP for HTTP Anomaly Detection in IDS
Nguyen, M. T. A., Tong, V., Bannour, S., & Souihi, S. (2025) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2025.3560040 · Cited by 13 · see citing works
Self-citationA systematic review on insider threat detection using natural language processing
Kundiya, K., & Haribhakta, Y. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-01145-6 · Cited by 9 · see citing works
High-performance network attack detection in unknown scenarios based on improved vertical model
Hou, S., Xiao, G., & Zhou, H. (2024) · Cluster Computing · doi:10.1007/s10586-024-04840-6 · Cited by 7 · see citing works
An, Y., Yu, F. R., He, Y., Li, J., Chen, J., & Leung, V. C. M. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3454777 · Cited by 2 · see citing works
Detailed Program CNSM 2017 Detailed Program
(2023) · International Conference on Network and Service Management (CNSM) · doi:10.23919/cnsm59352.2023.10327824
Program at a Glance Program at a Glance
(2023) · International Conference on Network and Service Management (CNSM) · doi:10.23919/cnsm59352.2023.10327819
(2023) · International Conference on Network and Service Management (CNSM) · doi:10.23919/cnsm59352.2023.10327835
Feature Engineering-Driven Evolution Analysis and Detection of Unknown Attacks
Li, G., Liu, S., Ao, M., & Zhang, X. (2025) · IEEE International Conference on Information Systems and Computer Aided Education (ICISCAE) · doi:10.1109/iciscae66104.2025.11307706
Exploratory Detection of Unknown Cyber-Attacks via Evolutionary Strategy and Machine Learning
Fang, W., Li, G., Liu, S., Zhang, L., Ao, M., Wang, Q., & He, J. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3673137
Roshna, D., Sritha, K. N., & Namee, K. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-26319-3_36
Trustworthy and Temporally Robust Web Attack Detection for Autonomous Edge Network Security
Deng, J., Liu, B., Liao, Z., Ren, Z., Du, Z., Zhang, Y., & Li, J. (2026) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2026.3721464
From Machine Learning to LogBERT: A Survey of Web Log Anomaly Detection for APT and Botnet Threats
Altmimi, S., & Alomari, E. S. (2026) · Al-Noor Journal of Engineering Management and Computer Science · doi:10.71229/7tzh0144
- Authors
- Anh Nguyen, M. T., Tong, V., Souihi, S. B., & Souihi, S.
- Affiliations
- School of Information and Communication Technology, Hanoi University of Science and Technology,Vietnam
- Trường Đại học Khoa học và Công nghệ Hà Nội (VN)
- Université Paris-Saclay, CEA, List,Palaiseau,France,F-91120
- Université Paris-Est Créteil (FR)
- Venue
- 2023 19th International Conference on Network and Service Management (CNSM)
- Publisher
- IEEE
- Published
- 2023-10-30
- Pages
- 1-8
- OpenAlex
- W4389077338
- Cited by
- 12
- References
- 18
- Citations by year
- 2026: 4 · 2025: 3 · 2024: 2 · 2023: 3
- FWCI
- 3.61
- Type
- conference paper
- Language
- en
- Open access
- green
- hal.science
- Locations
- International Conference on Network and Service Management (CNSM) (publishedVersion)
- HAL (submittedVersion, other-oa)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- web application security, BERT, transfer learning, cyberattack detection, unknown attack detection, web application attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
