An Attack Detection Framework Based on BERT and Deep Learning

Yunus Emre Seyyar

doi:10.1109/ACCESS.2022.3185748

Return

An Attack Detection Framework Based on BERT and Deep Learning

2022-01-01

Yunus Emre Seyyar *

A. Gökhan Yavuz

Halil Murat Ünver

DOI：10.1109/ACCESS.2022.3185748

Original

Original request for help

Save

Abstract

En 中文

Deep Learning (DL) and Natural Language Processing (NLP) techniques are improving and enriching with a rapid pace. Furthermore, we witness that the use of web applications is increasing in almost every direction in parallel with the related technologies. Web applications encompass a wide array of use cases utilizing personal, financial, defense, and political information (e.g., wikileaks incident). Indeed, to access and to manipulate such information are among the primary goals of attackers. Thus, vulnerability of the information targeted by adversaries is a vital problem and if such information is captured then the consequences can be devastating, which can, potentially, become national security risks in the extreme cases. In this study, as a remedy to this problem, we propose a novel model that is capable of distinguishing normal HTTP requests and anomalous HTTP requests. Our model employs NLP techniques, Bidirectional Encoder Representations from Transformers (BERT) model, and DL techniques. Our experimental results reveal that the proposed approach achieves a success rate over 99.98% and an F1 score over 98.70% in the classification of anomalous and normal requests. Furthermore, web attack detection time of our model is significantly lower (i.e., 0.4 ms) than the other approaches presented in the literature.

Keywords:

Protocols

Bit error rate

Natural language processing

Uniform resource locators

Structured Query Language

Firewalls (computing)

Deep learning

Anomalous request

BERT

deep learning

web attack