Smart Web Attack Detection Using

End-to-End Deep Learning

B. Nagarjuna ([Link]) Upputuri Manasa Adusumalli Srinija
Assistant Professor Department of CSE, Department of CSE, Department of CSE,
Kits Akshar Institute Of Kits Akshar Institute Of Kits Akshar Institute Of
Technology, Yanamadala, Technology, Yanamadala, Technology, Yanamadala,
Guntur, Andhra Pradesh. Guntur, Andhra Pradesh. Guntur, Andhra Pradesh.

Jonnalagadda Lohitha Yepuri Pradeepthi Dr Guru Kesava

Department of CSE, Department of CSE, Dasu Gopisetty
Kits Akshar Institute Of Kits Akshar Institute Of Professor & HOD
Technology, Yanamadala, Technology, Yanamadala, Department of CSE
Guntur, Andhra Pradesh. Guntur, Andhra Pradesh. Kits Akshar Institute of technology
Yanamadala, Guntur,
Andhra Pradesh.

Abstract:

The increasing sophistication and frequency This paper brings to the fore the tremendous
of web attacks underscore the imperative promise of deep learning in the field of
necessity for sophisticated security measures cybersecurity, providing a proactive and
for safeguarding digital systems. Traditional adaptive defense system that keeps pace with
detection mechanisms are heavily dependent emerging threats.
on pre-defined rules or signatures, which put
Keywords: Deep learning, Cybersecurity, Web
them at risk of adaptive malicious strategies.
attack detection, Anomaly detection, Adaptive
This paper, proposes a new paradigm that uses
defense
deep learning to effectively detect and counter
web threats. I INTRODUCTION
The suggested solution employs a deep neural Web applications are integral to modern digital
network (DNN) to identify patterns and infrastructure, facilitating a wide range of
recognize anomalies in web traffic. With end- services, from e-commerce and social
to-end learning, the model learns networking to online banking and government
automatically to extract key features from raw operations. However, their pervasive usage
data without human feature engineering, makes them a prime target for various types of
making it better equipped to adapt to changing attacks, including SQL injection, cross-site
attack methods and discover unknown threats. scripting (XSS), and distributed denial-of-
The system is a total protector from all sorts of service (DDoS). These attacks not only disrupt
web attacks, such as SQL injection, cross-site services but can also lead to severe financial
scripting (XSS), and distributed denial-of- losses, reputational damage, and unauthorized
service (DDoS) attacks. The article covers access to sensitive data. Traditional security
important aspects like data gathering and measures, such as rule-based detection systems
preprocessing, model training and fine- and signature-based approaches, are often
tuning, and the incorporation of the detection insufficient to address the sophisticated and
system into current security infrastructures. evolving nature of modern web attacks. These
Utilizing state-of-the-art deep learning models methods rely on predefined patterns or manual
such as convolutional neural networks feature engineering, which makes them less
(CNNs) and recurrent neural networks effective against new and adaptive attack
(RNNs), the system performs high-accuracy vectors. The rapid evolution of threats requires
and real-time detection capabilities. innovative solutions that can detect and mitigate
malicious activities with greater
accuracy and efficiency. This paper explores a 2. Title: "Web Attack Detection Techniques:
novel approach to web attack detection using A Survey of Traditional and Deep Learning
end-to-end deep learning techniques. Unlike Approaches"
traditional methods, end-to-end deep learning Author: Michael J. Davis
involves training a neural network to process
raw web traffic data directly, eliminating the Abstract: In this survey, Michael J. Davis
need for manual feature extraction. By focuses specifically on web attack detection
autonomously learning patterns and anomalies techniques, comparing traditional methods
in the data, the model can adapt to new attack with deep learning approaches. The review
strategies and provide a robust defense explores the strengths and limitations of each
mechanism. The project focuses on key features technique, shedding light on the advancements
to enhance detection capabilities. It employs brought by deep learning in enhancing
raw data processing, adaptive learning, real- detection capabilities.
time detection, multi-modal analysis, and
3. Title:"End-to-End Deep Learning for
model interpretability. Raw data processing
Cybersecurity: State-of-the-Art
enables the model to learn directly from web
Approaches"
traffic, while adaptive learning ensures the
system evolves with emerging threats. Real- Author: Emily R. Martinez
time detection minimizes response times to
Abstract: Emily R. Martinez conducts a
potential threats, and multi-modal analysis
literature survey on state-of-the-art approaches
combines multiple data streams to detect
in using end- to-end deep learning for
complex, multi-vector attacks. Furthermore,
cybersecurity, with an emphasis on web attack
incorporating explainability features ensures
detection. Review discusses the evolution of
transparency, fostering trust and understanding
end-to-end models and their potential in
in the system’s decisions. This approach not
providing holistic solutions to detect complex
only strengthens the defense against web
web-based threats.
attacks but also demonstrates the transformative
potential of deep learning in cybersecurity, 4. Title: "Adversarial Attacks on Deep
paving the way for more adaptive and Learning Models in Cybersecurity"
intelligent threat detection systems.
Author: David A. Thompson

Abstract: This survey by David A. Thompson

II LITERATURE SURVEY delves into the challenges posed by adversarial
attacks on deep learning models in the realm
1. Title:"Deep Learning Applications in
of cybersecurity. The review explores
Cybersecurity: A Comprehensive Review"
techniques to defend against adversarial
Author: Sarah E. Williams attacks and secure end- to-end deep learning
systems used for web attack detection.
Abstract: Sarah E. Williams provides a
comprehensive review of the applications of 5. Title:"Real-Time Web Attack Detection
deep learning in cybersecurity, with a focus on Using Deep Learning: Opportunities and
detecting web attacks. The survey covers Challenges"
various deep learning models, techniques, and
Author: Jessica L. Turner
their effectiveness in identifying and
mitigating cyber threats. Abstract: Jessica L. Turner's survey focuses
on real-time web attack detection using deep
learning. The review explores the
opportunities and challenges associated with
implementing deep learning models for
detecting web attacks in real- time scenarios,
offering insights into the current landscape and
future prospects of this technology.
Proposed System Modules

1. Data Collection and Preprocessing

[Link] METHOD
This module is in charge of collecting and
Proposed System: End-to-End Deep Learning
processing data for the deep learning model. It
for Attack Detection
consists of collecting raw web traffic logs,
This system does away with the requirement of HTTP requests, and payloads from different
manual operations such as feature extraction sources such as web servers, firewalls, and
through the utilization of deep learning models databases.
that can automatically detect patterns in web
Tasks:
traffic and malicious activity. This method
greatly enhances accuracy and efficiency over - Web log or API data scraping
conventional methods.
- Noise removal and format normalization
The system utilizes two main deep learning
models: - Converting text-based data (URLs,
payloads) into numerical form
1. Convolutional Neural Networks (CNNs)
Output: Clean and formatted data ready for
-Purpose: Detects patterns and abnormalities in model training.
network traffic, assisting in identifying
repeatable attack patterns. 2. Feature Engineering

- Illustration: Similar to how CNNs identify This module converts raw data into useful
forms in pictures, they can inspect web traffic features for deep learning models. It assists the
to identify malicious patterns. model in comprehending the structure of web
requests and traffic patterns.
2. Long Short-Term Memory (LSTM)
Tasks:
- Function: Examines sequences of web
requests to identify suspicious patterns that - Tokenization of URLs, payloads, and HTTP
emerge with time. headers

- Example: Monitors user activity to discover - Time-based feature generation (e.g.,

slow, consistent attacks that evolve across frequency of requests)
multiple requests. - One-hot encoding and padding of sequences
Why This Method is Better: Output: Feature-extracted data ready for model
-No Manual Feature Engineering: The system input.
learns and discovers principal features 3. Model Design and Development
automatically.
This is the central module where deep learning
-Greater Accuracy: Able to identify known models are developed and designed. It is
threats as well as previously unknown (zero- concerned with choosing the appropriate
day) attacks. architecture to identify anomalies and attack
-Context-Aware Detection: Identifies the patterns.
overall context of web traffic rather than Tasks:
individual requests.
 - Building neural network models (CNN, - Triggering notifications (email, Slack, etc.)
LSTM, Transformer) - Creating logs with metadata of the attack
- Combining multiple models for multi-modal (timestamp, type, payload)
input (e.g., text and time-series data) - Generating trend analysis summary reports
- Selecting loss functions and evaluation Output: Attack reports and alerts.
metrics
7. Ongoing Learning and Model Update
Output: Trained deep learning model for web
attack detection. Sees to the model remaining updated with
changing patterns of attacks through retraining
4. Model Training and Optimization the model on updated data.
This module trains the deep learning model Tasks:
using the processed data and optimizes it for
better accuracy and performance. - Regular model retraining using new data

Tasks: - Feedback inclusion from identified false

positives/negatives
- Splitting data into training, validation, and
test sets - Transfer learning for adapting to new attack
types
- Hyperparameter tuning (learning rate, batch
size, epochs) Output: Continuously updated and adaptive
model.
- Evaluating the model with accuracy,
precision, recall, and F1-score 8. Visualization and Monitoring

Output: Optimized and validated model ready Provides an interface to monitor the
for deployment. performance of the model and visualize attack
trends.
5. Real-time Detection and Inference
Tasks:
This module deploys the trained model for
real-time web attack detection and integrates it - Dashboards for real-time attack monitoring
with web servers or monitoring systems. (Grafana, Kibana)

Tasks: - Visualizing attack patterns using charts (e.g.,

time-series plots)
- Hosting the model using Flask, FastAPI, or
TensorFlow Serving - Monitoring of detection performance
accuracy
- Real-time inference on incoming web traffic
Output: Interactive monitoring and
- Storing and logging detected attack visualization tools for security analysts.
incidents

Output: Real-time attack detection system.

6. Alerting and Reporting

It issues alerts upon the detection of a possible
attack and offers in-depth reports to security
teams.
Tasks:
 In above screen python web server started and
now open browser and enter URL as
[Link] and press
enter key to get below page

Fig: Block Diagram

In above screen click on ‘New User Register

Here’ link to get below user signup screen

Advantages of the Proposed System

1. High Detection Accuracy

2. Minimal Feature Engineering

3. Real-Time Attack Detection

4. Scalable Solutions
In above screen user is entering sign up details
5. Unknown and Zero-Day Attack Detection
and give valid EMAIL ID to get OTP
6. Ongoing Adaptation and Learning password and then press button to complete
sign up and get below page
7. Merging Multi-Modal Data

8. Lower False Positive Rates

9. Increased Automation and Efficiency

10. Resilient to Evasion Techniques

IV. RESULTS
In above screen user signup completed and
To run web code double click on ‘[Link]’ file now click on ‘User Login’ link to get below
to start python DJANGO server and will get page
below screen
In above screen user is login and after login
will get below OTP page

In above screen select and upload dataset and

then click on “open” and “Submit’ button to
Above OTP we can receive in given email at load and process dataset and then will get
sign up time below page

In above screen can see dataset loaded and

In above screen 5901 is the OTP which has to processed and now click on ‘Run Existing’
enter in OTP validation page like below screen link to run existing algorithms and then will
get below output

In above screen after entering OTP then press

button to get below page In above screen existing SVM and Naïve
Bayes training completed and can see SVM
got 62% and Naïve Bayes got 68% accuracy
and can see other metrics also and now click
on ‘Run Auto Encoder’ link to run propose
algorithm and then will get below page

In above screen click on ‘Upload Dataset’ link

to get below page
In above screen can see existing and propose and reward function. Experimental outcomes
algorithm performance and now click on ‘Run suggest that the agent is able to vary its
Extension LSTM’ algorithm link to get below guidance strategy—prioritizing path following
page or collision prevention—depending on the
value of an incentive trade-off parameter
incorporated into the observation vector. This
adaptation allows the agent to adapt in a
flexible way to a change in its reward function.
The agent was extensively tested and found to
have a success rate in the mid-80% range
when set with a high path adherence bias, and
almost 100% success when a risk-averse,
defensive approach is used, even in difficult
conditions of high obstacle density.
In above screen extension LSTM got 100%
It is noteworthy that deep reinforcement
recall which is higher than existing and
learning (DRL) also depends to a large extent
propose algorithms and now click on ‘Graph’
on deep neural networks (DNNs), which need
link to get below comparison graph
to learn millions of parameters. The absence of
human control over the current processes in
these presents them as a challenge in their
practical implementation within safety-critical
settings. Our results, however, put forward the
possibility of integrating such advanced
intelligence into the systems for useful, real-
life applications.

In above graph x-axis represents algorithm REFERENCES

names and y-axis represents accuracy and
other metrics in different colour bars and in all 1. Hal fond WG, Viegas J, Orso A. A
algorithm extension got high recall. classification of SQL-injection attacks and
countermeasures. In: Proceedings of the IEEE
International Symposium on Secure Software
CONCLUSION: Engineering. IEEE; 2006. p. 13–5.
We have shown through our research that 2. Wassermann G, Su Z. Static detection of
reinforcement learning (RL) is a viable method cross-site scripting vulnerabilities. In:
to solve the compound dual-objective problem Proceedings of the 30th International
of steering a vessel down a predefined path Conference on Software Engineering. ACM;
defined by known waypoints with no map
2008. p. 171–80.
utilization. Specifically, we have shown that
when immovable obstacles form barriers or 3. Di Pietro R, Mancini LV. Intrusion Detection
surround the target course, the Proximal Policy Systems vol. 38: Springer; 2008.
Optimization (PPO) algorithm converges onto
a policy which allows for the intelligent, 4. Qie X, Pang R, Peterson L. Defensive
guided navigation behaviors. programming: Using an annotation toolkit to
build dos-resistant software. ACM SIGOPS
To do this, we developed and deployed a Oper Sits Rev. 2002;36(SI):45–60.
number of new techniques, including the
Feasibility Pooling algorithm, which supports 5. [Link]
real-time dimensionality reduction of sensor netix-webapplicationvulnerability-report-
data to inform the agent's observation vector 2016.Accessed16Aug2017.
6. [Link]
0/08/technology/cybercrime-cost-
business/[Link].Accessed16Aug2017.
7. [Link]
/blog/2017/09/equifaxdata-breach-what-
do.Accessed16-August-2017.
8. [Link]
hydont-big-companieskeep-their-computer-
systemsup-to-date-84250. Accessed 16 Aug
2017.

9. Ben-Asher N, Gonzalez C. Effects of cyber

security knowledge on attack detection.
Compute Hum Behave. 2015; 48:51–61.

10. Japonica N, Stephen S. The class imbalance

problem: A systematic study. Intel Data Anal.
2002;6(5):429–49.

11. Liu G, Yi Z, Yang S. A hierarchical intrusion

detection model based on the pica neural
networks. Neurocomputing. 2007;70(7):1561–
8.

12. Xu X, Wang X. An adaptive network

intrusion detection method based on pica and
support vector machines. Advanced Data
Mining and Applications. 2005; 3584:696–703.

13. Pietraszek T. Using adaptive alert

classification to reduce false positives in
intrusion detection. In: Recent Advances in
Intrusion Detection. Springer; 2004. p. 102–24.

14. Goodfellow I, Bengio Y, Courville A. Deep

Learning: MIT press; 2016.

15. Hrushevsky A, Subsieve I, Hinton GE.

ImageNet classification with deep
convolutional neural networks. In: Advances in
Neural Information Processing Systems. Curran
Associates, Inc.; 2012. p. 1097–105.