Source-linked AI summary
X-WAD: eXplainable Web Anomaly Detection
Matteo Bitussi, Roberto Doriguzzi-Corin
TL;DR
The paper examines how Transformer-based Language Models can detect HTTP anomalies while remaining interpretable, despite the risks of contaminated normal-data training sets. It introduces X-WAD, which reuses token-level logits for anomaly scoring and heatmap-like explanations. Applying the tool to SR-BH2020 exposed labeling inconsistencies, anomalous contamination, and backdoor-like detection failures, while fixing the dataset substantially reduced false negatives.
Problem
Transformer-based anomaly detectors are difficult to interpret, while contaminated training data can cause attack patterns to be treated as normal.
Method
X-WAD uses token-level scores from TLM output logits to explain HTTP anomaly decisions, comparing causal SmolLM2-360M and bidirectional ModernBERT-large detectors.
Results
13.8% of the dataset was identified as mislabeled, and fixing it reduced FNR from around 24% and 15% to 3.02% and 2.12% for ModernBERT-large and SmolLM2-360M, respectively.
Takeaways & Limitations
X-WAD enables analysts to verify whether known attack patterns are correctly identified and to investigate model failures caused by training-data contamination.
Abstract
from arXiv · showhide
The rapid growth of web-based services, particularly API-driven architectures, reflects an increasing reliance on distributed systems, exposing sensitive data to security risks and making the adoption of automated defensive mechanisms essential. In this context, where benign traffic predominates in real-world settings, modern defenses increasingly model normal behavior, relying on semi-supervised approaches trained on only normal data. However, ensuring the complete absence of anomalous instances in such training data is inherently difficult in practice, and mislabeled or contaminated attack samples can introduce backdoors into the learned defense, causing the model to silently misclassify certain attack patterns as normal behavior. This paper investigates the effectiveness of Transformer-based Language Models (TLMs) in the detection of anomalies in HTTP requests, focussing on providing detailed explanations for the detected anomalies. The study employs token-level logit-based surprisal mapping to provide both an anomaly score and a direct, detailed explanation via heatmap-like highlighting. The effectiveness of the proposed explainability approach is demonstrated by the discovery of labelling inconsistencies in a popular public dataset, revealing how anomalous contamination in the training data had induced backdoor-like failures in the detection models.
I. INTRODUCTION
X-WAD addresses the interpretability limits of Transformer-based anomaly detection for HTTP requests by using token-level model outputs to explain decisions. The study also uses these explanations to uncover contamination and labeling inconsistencies in the SR-BH2020 dataset.
- Web anomaly detection is difficult because attacks evolve rapidly while web traffic is large, heterogeneous, and predominantly benign.
- Transformer-based methods for HTTP anomaly detection include feature extraction, classification, prediction or reconstruction, and prompting.
- X-WAD derives token-level scores from TLM output logits to highlight request components contributing most to anomalous classifications.
- The study compares causal SmolLM2-360M prediction-based detection with bidirectional ModernBERT-large reconstruction-based detection on SR-BH2020.
- X-WAD revealed labeling inconsistencies and anomalous training contamination that induced backdoor-like detection failures, while enabling a corrected dataset.
- Unlike SHAP-based and token-removal approaches, X-WAD reuses logits already computed for anomaly scoring and therefore adds virtually no computational cost.
III. THREAT MODEL
The threat model considers Internet-exposed web applications attacked through crafted HTTP requests. It covers adversaries exploiting input-validation weaknesses and application-logic flaws.
- Attackers are external entities that interact with the exposed web application exclusively through HTTP requests.
- The model assumes attackers can craft arbitrary request payloads to exploit input-validation weaknesses and application-logic flaws.
- The threat landscape includes injection attacks, dictionary-based attacks, and path-traversal attacks.
IV. METHODOLOGY
X-WAD uses the output logits of normality-modeling TLMs to calculate anomaly scores and highlight unexpected HTTP-request tokens. The inference procedure differs between causal prediction and masked reconstruction models.
- Inference: X-WAD assumes a TLM trained exclusively on benign requests and flags inputs that significantly deviate from the learned normal distribution.
- Inference: Causal language modeling predicts each next token from preceding tokens using autoregressive inference and a lower-triangular attention mask.
- Inference: Masked language modeling reconstructs masked tokens using bidirectional context and compares predicted distributions with the true token values.
- Inference: Both model types produce per-token output logits that X-WAD uses for explanations and for averaging token-level losses into an anomaly score.
B. Explainability
X-WAD converts per-token model probabilities into visual explanations and uses the same loss values to classify requests. In the illustrated case, the highlighting identifies a path-traversal pattern in an atypical header location.
- Per-token probabilities are recovered from cross-entropy losses as P = e^-L and used to color the original request tokens.
- Low predicted probability indicates an unexpected token in the context of the benign data distribution.
- The example request is classified as anomalous primarily because ../../etc/passwd appears in the Referer header, an atypical location.
- The anomaly score averages per-token losses and compares the result with a precomputed threshold to classify the request as anomalous or benign.
V. EXPERIMENTAL SETUP
The study evaluates two similarly sized Transformer language models on the SR-BH2020 HTTP attack-detection dataset, using distinct predictive and reconstructive objectives. Requests are represented as concatenated components, while server responses are excluded to avoid bias.
- Models: ModernBERT-large uses masked language modeling, whereas SmolLM2-360M uses causal language modeling for anomaly detection.ModernBERT-large has approximately 395 million parameters; SmolLM2-360M is the 360M-parameter variant.
- Models: Both models have approximately 400M parameters and use Byte-level Byte Pair Encoding tokenizers.
- Dataset: SR-BH2020 contains HTTP requests collected from an internet-exposed WordPress server and is used as a benchmark for HTTP attack detection.
- Dataset: The dataset is unbalanced, with most samples normal and anomalous samples distributed across 11 classes with varying frequencies.
- Preprocessing: Each request’s method, path, headers, and body are concatenated into one input string, while server response information is excluded to avoid bias.
C. Training
Training uses normal-only data and selects an anomaly threshold from validation-loss statistics. The tuning procedure balances false positives against the risk of missing malicious requests.
- Data split: The training and validation sets contain only normal samples, while the test set combines the remaining normal samples with all anomalous samples.The normal data are split 70% for training, 20% for validation, and 10% for testing.
- Thresholding: The threshold τ is set as τ = µ+k·σ, where µ and σ are validation anomaly-score mean and standard deviation, and k calibrates the threshold.
- Threshold tuning: k = 0.5 is selected where validation FPR begins to stabilize, balancing sensitivity and robustness.Larger k values reduce FPR but increase runtime FNR, potentially leaving malicious samples undetected.
E. Evaluation
Evaluation uses an unseen, imbalanced test set containing benign and anomalous requests. Performance is assessed with error-rate and recall-oriented metrics, including F1 for balancing precision and recall.
- Test set: The test set contains unseen benign and anomalous requests and is unbalanced toward the positive class.It includes all 382K anomalous samples and around 52K benign samples.
- Metrics: FPR measures benign requests incorrectly classified as malicious, while FNR measures malicious requests incorrectly classified as benign.
- Metrics: Recall, or TPR, measures the proportion of malicious samples correctly classified as malicious.
- Metrics: F1 is the harmonic mean of precision and recall and balances their trade-off for imbalanced datasets.
VI. RESULTS
The experimental workflow evaluates two TLM detectors, applies statistically grounded thresholding, and uses X-WAD to investigate failures. On the original dataset, both models exhibit substantial false negatives, motivating contamination analysis.
- Experimental workflow: The workflow trains and evaluates SmolLM2-360M and ModernBERT-large, thresholds validation losses, and uses X-WAD to analyze model failures and training-data quality.
- Original dataset: 23.96% FNR for ModernBERT-large and 14.82% FNR for SmolLM2-360M are observed on the original dataset.Hyperparameter tuning did not meaningfully reduce FNR.
- Original dataset: The original-dataset results are summarized in Table II.
B. Explainability and dataset fixing
X-WAD exposed attack patterns that the models treated as normal, enabling systematic identification of labeling inconsistencies and construction of a corrected dataset. The correction used pattern-based relabeling, with only a subset manually inspected.
- False-negative analysis: X-WAD analysis of false negatives showed that both models assigned near-zero anomaly scores to a command-injection pattern in sample 298021.The highlighted substring was %7C%7Ccat+%2Fetc%2Fpasswd, despite being a known attack indicator in malformed URI-path position.
- False-negative analysis: Similar attack patterns appeared in both anomalous samples and many samples labeled normal, indicating labeling inconsistencies in SR-BH2020.The behavior suggested that these patterns had entered the models’ learned notion of normality.
- Dataset fixing: Approximately 13.8% of the dataset was identified as mislabeled by searching normal-labeled samples for attack patterns found in false negatives.The analysis linked training-data contamination to degradation in detection performance.
- Dataset fixing: SR-BH2020-fix reclassified normal samples as anomalous when they exhibited the identified attack patterns.The revised dataset was then used to retrain both models with the same method.
- Dataset fixing: Exhaustive verification of modified samples was infeasible, so some benign samples may have been incorrectly relabeled as anomalous.Only a subset of modified samples was manually inspected.
C. Model evaluation on fixed dataset
Retraining on the revised dataset substantially improved detection for both TLMs, reducing false negatives across nearly all CAPEC classes. On the representative sample, both models recovered the attack pattern, but their highlighting differed in selectivity.
- Overall performance: FNR decreased from around 24% to 3.02% for ModernBERT-large and from around 15% to 2.12% for SmolLM2-360M.The revised-dataset results showed marked reductions for both models.
- Class-level performance: FNR decreased across 10 of the 11 CAPEC classes that had non-zero original FNR for both models.Protocol Manipulation was the exception, suggesting that some patterns in that class were not fully captured during refinement.
- Explainability after correction: Both models assigned high loss values to the tokens in %7C%7Ccat+%2Fetc%2Fpasswd after training on SR-BH2020-fix.This corrected the earlier near-zero anomaly scoring for the representative attack pattern.
- Explainability after correction: SmolLM2-360M highlighted the entire anomalous sequence but flagged more benign tokens, whereas ModernBERT-large was more selective and produced fewer false positives.The differences were partly attributed to tokenization vocabularies and partly to masked versus causal architectures.
VII. CONCLUSIONS
X-WAD supports inspecting model decisions to verify whether inputs are classified as intended, while exposing contamination-related backdoor-like failures. The evaluation also identifies boundaries around labeled-data availability and the current HTTP-request focus.
- Training-data contamination can induce backdoor-like behaviors in normality-modeling anomaly detectors, causing specific attacks to be systematically misclassified as benign.The issue is especially relevant when contamination remains undetected in deployment.
- X-WAD reveals whether well-known attack patterns are correctly identified as anomalous by explaining why samples receive anomalous or benign classifications.This supports verification of intended model behavior on SR-BH2020.
- Explicit FNR and FPR quantification relied on a labeled test set, which is not always available in real-world deployments.The authors propose applying explainability to randomly sampled benign-classified inputs as an alternative validation strategy.
- The study focused on HTTP-request explainability, while applications to system logs, API calls, and operational settings remain future work.The proposed approach is described as generalizable to other textual data, but those applications are intended to verify generalizability and practical effectiveness.