PaperlayerView exact revision on arXiv

Source-linked AI summary

Comparative Evaluation of Static Embedding Models for HTTP Request Anomaly Detection

Amanda Riverol, Gustavo Betarte, Rodrigo Martínez, Álvaro Pardo

arXiv:2609.26860v1cs.CRcs.AI

TL;DR

Rule-based WAFs can produce elevated false positives, and existing studies lack equivalent-condition comparisons of static embeddings for HTTP anomaly detection. This paper compares static embedding representations in an unsupervised detection setting. FastText is the most consistent across datasets, and its request representation base achieves complete attack coverage against a much lower coverage figure for other techniques.

  • Problem

    Prior studies lack systematic comparisons of static embeddings across equivalent HTTP request environments, while inefficient WAF rule management can elevate false positives.

    Source: §I · p. 1, B. Static Embedding Models for HTTP… · p. 4

  • Method

    The paper compares static embedding representations while holding remaining pipeline components fixed to attribute performance differences to the representation.

    Source: §I · p. 2, §IV · p. 6

  • Results

    FastText is the most consistent across datasets, and its canonical request representation base achieves 100% attack coverage compared with 6.6% for other techniques.

    Source: C. Selection of One-Class Anomaly… · p. 9, §VI · p. 10

  • Takeaways & Limitations

    FastText’s subword modeling mitigates out-of-vocabulary issues, and FastText with OCSVM is reported as the most effective combination for reducing false positives without affecting detection.

    Source: §VI · p. 10

Abstract

from arXiv · show

Web applications are increasingly targeted by cyberattacks that exploit HTTP requests to evade security mechanisms. Traditional web application firewalls (WAFs) rely on rule-based approaches that often exhibit high false positive rates and limited adaptability. Recent studies have explored machine learning techniques and word embedding models to improve anomaly detection in HTTP traffic. This paper presents a benchmark for static embedding models, specifically Word2Vec, FastText, and Doc2Vec, within a unified, single-class classification framework. We propose HEDA (HTTP Embedding-Based Detection Architecture), a modular detection pipeline that combines static embedding representations with single-class anomaly detection models to detect anomalies at the request level. The approach operates in an unsupervised environment, where both the embedding models and detectors are trained exclusively on benign HTTP traffic. The proposed methodology is evaluated on three datasets with heterogeneous characteristics, including both synthetic and real traffic. The experimental results show that the choice of embedding representation significantly affects detection performance, and that FastText-based embeds produce the most consistent results across all datasets, achieving high detection rates while keeping false positive rates under control.

I. INTRODUCTION

Growing, heterogeneous HTTP traffic and adaptive attacks challenge fixed-rule defenses, while conventional text representations miss semantic and contextual information. The paper compares static embeddings as computationally efficient alternatives for unsupervised HTTP anomaly detection.

I. INTRODUCTION

  • Growing HTTP request volume, diversity, and complexity make malicious activity harder to identify among legitimate traffic.The expansion of web applications also increases the attack surface.Source: §I · p. 1
  • Adaptive attacks and variants can evade traditional mechanisms based on fixed rules.This motivates detection approaches that can adapt to evolving attack behavior.Source: §I · p. 1
  • Inefficient management of WAF rules can elevate false positives and disrupt legitimate traffic.Rule-based WAFs depend heavily on security specialists to configure, tune, and maintain detection rules.Source: §I · p. 1
  • Static Word2Vec, Doc2Vec, and FastText are compared as computationally efficient representations for unsupervised intrusion detection.The evaluation aims to inform training and inference pipeline design for WAFs.Source: §I · p. 2

II. RELATED WORK

  • Prior static-embedding evaluations span varied NLP contexts, including linguistic evaluation, sentiment analysis, and text classification.The paper draws on this methodological background to examine web-application anomaly detection.Source: §II · p. 2

A. Static Embedding Models in Natural Language Processing

Prior work evaluates static embeddings across general NLP and applies them to HTTP anomaly detection, but the latter lacks systematic comparisons under equivalent conditions.

A. Static Embedding Models in Natural Language Processing

  • General NLP studies compare static embeddings across languages, tasks, and preprocessing conditions, with model performance varying by task and input.Reported examples include FastText performing well on short, noisy text and static embeddings performing better on cleaned text in one comparison.Source: A. Static Embedding Models in Natural… · p. 2
  • Surveys contrast static and contextual embeddings, noting contextual models’ stronger handling of context and polysemy in NLP tasks.Their taxonomies and evaluation methods inform domain-specific embedding comparisons.Source: A. Static Embedding Models in Natural… · p. 2
  • Other NLP studies attribute FastText’s performance in news classification partly to subword handling of out-of-vocabulary terms.An ensemble of embedding vectors has also been used for product-review analysis.Source: A. Static Embedding Models in Natural… · p. 2

B. Static Embedding Models for HTTP Anomaly Detection

  • HTTP anomaly-detection studies use varied representations and classifiers, including TF-IDF features, Word2Vec, RoBERTa, FastText, and Doc2Vec,,,.Reported approaches include Word2Vec combined with TF-IDF, FastText in an autoencoder, and Doc2Vec features for XSS detection.Source: B. Static Embedding Models for HTTP… · p. 3
  • Existing HTTP studies use heterogeneous evaluation conditions, leaving no systematic comparison of embeddings across equivalent request environments.Common TF-IDF approaches can be competitive but depend on expert-selected tokens, motivating automated representation learning.Source: B. Static Embedding Models for HTTP… · pp. 3–4

III. STATIC EMBEDDING MODELS

Static embeddings assign fixed vectors, whereas contextual models vary representations with context; the paper describes trade-offs in expressiveness and computational demands.

  • Word2Vec assigns each word one static vector regardless of its context and learns relationships from local context windows [19].Source: §III · p. 4
  • Doc2Vec extends Word2Vec to learn global representations of sentences or documents, but still produces static vectors and may offer only modest improvements.Source: §III · p. 4
  • FastText extends Word2Vec with character-level n-grams to better handle uncommon, morphologically complex, or unseen words, while still producing static embeddings.Source: §III · p. 4
  • Contextual models generate representations that vary with context and capture semantic differences between sentences, unlike fixed-vector static embeddings.The passage names BERT and RoBERTa as examples.Source: §III · p. 4
  • Contextual models can better represent polysemy and subtle semantic relationships, but typically require more compute and memory and add inference latency.These demands can constrain real-time or resource-limited applications.Source: §III · p. 4

A. Selected Static Embedding Models

The section describes Word2Vec, Doc2Vec, and FastText as alternative static representations for HTTP requests, highlighting their architectures and distinct limitations.

A. Selected Static Embedding Models

  • Word2Vec learns token vectors from context; CBOW predicts a target word from surrounding context, while Skip-Gram predicts surrounding words from a target.Its performance depends on hyperparameter choices such as architecture, vector size, and context-window size.Source: 1) Word2Vec · pp. 4–5
  • Word2Vec can learn typical request structures from benign tokens, but its single vector per token leaves it sensitive to rare, malformed, or obfuscated tokens.The passage lists method names, URL paths, query parameters, and header values as HTTP-request tokens.Source: 1) Word2Vec · p. 5
  • Doc2Vec associates each text unit with a jointly trained fixed-length vector, capturing broader semantics beyond individual tokens.Its DM architecture predicts a target word from context words and a document identifier; DBOW predicts words from the document vector.Source: 2) Doc2Vec · p. 5
  • Doc2Vec can represent an HTTP request as one vector for request-level detection, but global representations may dilute localized anomalies and generalize poorly to unseen attack patterns.Source: 2) Doc2Vec · p. 5
  • FastText represents words using character n-grams, summing their vectors to form a word embedding.Character-level information can provide meaningful representations for out-of-vocabulary and obfuscated tokens common in malicious traffic.Source: 3) FastText · p. 5

IV. UNSUPERVISED LEARNING METHODOLOGY

The study compares static embedding representations for request-level HTTP anomaly detection because HTTP traffic has domain-specific properties that differ from natural language. HEDA keeps the detection pipeline modular so embedding representations can be compared under controlled conditions.

IV. UNSUPERVISED LEARNING METHODOLOGY

  • HEDA processes each HTTP request independently, enabling a controlled comparison of embedding representations and anomaly-detection algorithms.The architecture is shown in Fig. 3.Source: §IV · p. 5, Figure 3 · p. 6
  • The representation stage can swap static embedding models while keeping the remaining pipeline components fixed, attributing observed performance differences to the representation model.Source: §IV · pp. 5–6
  • Embeddings are trained offline for HTTP traffic to capture relationships involving special characters and tokens that can indicate malicious behavior.The paper contrasts this domain-tailored training with pretrained embeddings for general NLP tasks.Source: §IV · p. 6
  • The detection stage uses one-class learning and selects an anomaly-score threshold for inference; models are evaluated for recall while maintaining low FPR.The stated motivation emphasizes recall without a high number of false positives that could harm usability.Source: §IV · p. 6

V. EXPERIMENTAL RESULTS

The experiments examine how static representations affect HTTP request anomaly detection and compare one-class detectors using a uniform representation. Both embedding and anomaly-detection models are trained exclusively on legitimate requests.

V. EXPERIMENTAL RESULTS

  • The primary experimental objective is to measure how static embedding representations affect HTTP request anomaly-detection performance.Source: §V · p. 6
  • The first phase varies embedding representations while keeping the OCSVM unchanged to select a configuration suited to legitimate HTTP traffic.Source: §V · p. 6
  • A second phase compares one-class anomaly detectors using the same static embedding representation.Source: §V · p. 6
  • Embedding and anomaly-detection models are trained only on legitimate requests; validation data calibrates the operating point, and testing includes legitimate and malicious traffic.Source: §V · p. 6

A. HTTP Request Preprocessing

Preprocessing decodes each HTTP request twice, lowercases it, and tokenizes it into an ordered sequence for embedding-model input.

A. HTTP Request Preprocessing

B. Selection of Embedding Models and Hyperparameter Configurations

Across the evaluated datasets, FastText is more consistent than Word2Vec and Doc2Vec, though performance varies with the dataset. The selected Drupal configuration uses dimension 100 and window 7, while FastText's subword modeling provides complete token coverage.

B. Selection of Embedding Models and Hyperparameter Configurations

  • The Drupal dataset is primarily benign real-world HTTP traffic; valid requests train the models, while attack requests are reserved for testing and evaluation.Source: B. Selection of Embedding Models and… · p. 6
  • FastText representations consistently outperform Word2Vec and Doc2Vec with OCSVM, achieving the highest AUC and TPR across the evaluated configurations.Source: Table IV · p. 7, B. Selection of Embedding Models and… · p. 7
  • The embedding comparison explores 36 configurations across Word2Vec, FastText, and Doc2Vec, varying dimensions from 50 to 200 and context windows of 3, 5, or 7.Larger dimensions did not yield significant performance improvement.Source: B. Selection of Embedding Models and… · p. 7
  • FastText covers the entire valid and attack request set, whereas Word2Vec covers 85.1% of valid and 6.6% of attack requests.FastText uses character n-grams to generate representations for unseen tokens.Source: Table V · p. 7, B. Selection of Embedding Models and… · p. 7, Figure 4 · p. 8
  • The OCSVM is trained on valid requests, with ν and γ chosen from predefined sets; thresholds are swept from −25 to 25 in 0.01 steps and calibrated using validation data.The selected parameter combination maximizes the ˆF measure on normal and unlabeled validation requests.Source: B. Selection of Embedding Models and… · p. 7
  • AUC 0.96 and TPR above 80% are reported for FastText with d = 100 and w = 7, alongside a low FPR.This configuration is described as balancing detection performance and stability.Source: Figure 5 · p. 8, B. Selection of Embedding Models and… · p. 8
  • FastText provides more consistent performance across heterogeneous datasets, while Word2Vec and Doc2Vec are more sensitive to changes in data distribution.In Drupal, FastText combines low FPR with the highest AUC and TPR; in SR-BH 2020 it offers a more favorable TPR/FPR balance, while CSIC 2010 shows stability loss, particularly for Word2Vec and Doc2Vec.Source: Table VI · p. 8, B. Selection of Embedding Models and… · p. 8
  • The selected d = 100, w = 7 FastText configuration is retained for evaluation on two additional datasets after higher dimensions show no significant gain.CSIC 2010 contains synthetic requests, while SR-BH 2020 contains real-world honeypot traffic with 12 attack categories.Source: B. Selection of Embedding Models and… · p. 8

C. Selection of One-Class Anomaly Detection Models

FastText showed the most consistent performance across datasets, particularly with One-Class SVM, while other embedding models were less stable. The comparisons also show how detection and false-positive rates varied across datasets and baselines.

C. Selection of One-Class Anomaly Detection Models

  • The detector comparison used LOF and Isolation Forest alongside One-Class SVM, with all models trained offline on valid HTTP requests.The experiment compared detectors within the selected static embedding space and applied operating-point selection to calibrate thresholds.Source: C. Selection of One-Class Anomaly… · pp. 8–9
  • FastText was most consistent across datasets, particularly with One-Class SVM; Word2Vec varied more and Doc2Vec depended more on the detector.The representation choice considerably affected one-class anomaly detection performance.Source: C. Selection of One-Class Anomaly… · p. 9, Table VII · p. 9
  • On Drupal, FastText-OCSVM balanced detection and low FPR, while expert-selected features had slightly higher TPR but also higher FPR.The passage also reports reduced FPR versus ModSecurity configurations and greater robustness than expert-designed baselines.Source: C. Selection of One-Class Anomaly… · p. 9, Table VIII · p. 9
  • 90.09% TPR and 3.43% FPR: FastText-OCSVM achieved the highest TPR while keeping FPR controlled on SR-BH 2020.Rule-based methods had extremely low FPR but severely limited detection capability.Source: C. Selection of One-Class Anomaly… · p. 9, Table VIII · p. 9
  • On CSIC 2010, FastText-OCSVM had a more balanced profile than rule-based and traditional feature-engineering approaches.Representation-based approaches improved detection rates over manually engineered features while maintaining acceptable false-positive rates.Source: C. Selection of One-Class Anomaly… · p. 9

VI. CONCLUSION

The conclusion reports that FastText embeddings with OCSVM gave the best balance of TPR and FPR across the evaluated datasets. FastText’s subword modeling mitigated OOV issues, and the HEDA implementation surpassed the ModSecurity baseline.

VI. CONCLUSION

  • FastText with OCSVM achieved the best TPR–FPR balance across datasets, with FastText mitigating OOV issues and enabling 100% attack coverage versus 6.6% for other techniques.The conclusion says the HEDA implementation with FastText and OCSVM performed comparably to previous methods and surpassed the baseline, showing clear improvement over ModSecurity.Source: §VI · p. 10

VII. FUTURE WORK

Future work proposes testing alternative FastText aggregation methods, preserving local sequence information with sliding windows, and combining embeddings with HTTP-header validation features.

VII. FUTURE WORK

  • Future work will test max pooling and weighted averaging as alternatives to the current averaging of FastText embeddings.The study will assess whether these strategies produce richer vector representations.Source: §VII · p. 10
  • Sliding-window aggregation will be investigated to preserve sequential information and local context in HTTP request strings.Source: §VII · p. 10
  • The authors plan to combine token-embedding semantics with structural features from HTTP request metadata in a unified framework.The proposed integration would include validation mechanisms applied to HTTP headers.Source: §VII · p. 10

Related papers

Loading 2609.26860v1…