ntvНаучно-технический вестник информационных технологий, механики и оптикиScientific and Technical Journal of Information Technologies, Mechanics and Optics2226-14942500-0373Университет ИТМО10.17586/2226-1494-2026-26-4-783-792ntv-646Research ArticleКОМПЬЮТЕРНЫЕ СИСТЕМЫ И ИНФОРМАЦИОННЫЕ ТЕХНОЛОГИИCOMPUTER SCIENCEОбнаружение атак на веб-приложения на основе комбинирования трансформеров, сверточной нейронной сети и многослойного перцептронаWeb application attack detection based on a combination of transformers, convolutional neural network, and multilayer perceptronhttps://orcid.org/0009-0002-8091-8024СоболевП. С.SobolevP. S.

Соболев Павел Сергеевич — аспирант 

sc 59499265100

Санкт-Петербург, 197101

Pavel S. Sobolev — PhD Student

sc 59499265100

Saint Petersburg, 197101

pavels21@bk.ruhttps://orcid.org/0000-0001-6859-7120КотенкоИ. В.KotenkoI. V.

Котенко Игорь Витальевич — доктор технических наук, профессор, главный научный сотрудник

sc 15925268000

Санкт-Петербург, 199178

Igor V. Kotenko — D.Sc., Professor, Chief Researcher

sc 15925268000

Saint Petersburg, 199178

ivkote@comsec.spb.ruУниверситет ИТМОРоссияITMO UniversityRussian FederationСанкт-Петербургский Федеральный исследовательский центр Российской академии наукРоссияSt. Petersburg Federal Research Center of the Russian Academy of Sciences (SPC RAS)Russian Federation202627082026264783792Copyright © Соболев П.С., Котенко И.В., 20262026Соболев П.С., Котенко И.В.Sobolev P.S., Kotenko I.V.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://ntv.elpub.ru/jour/article/view/646

Введение. В связи с постоянным ростом количества атак на веб-приложения задача автоматического обнаружения таких атак остается одной из ключевых проблем информационной безопасности. Представлена разработка нового гибридного подхода к обнаружению атак на веб-приложения, в котором этап извлечения признаков переносится на уровень предварительно обученных трансформеров. Метод. Предлагается гибридный метод обнаружения атак на веб-приложения, основанный на совместном использовании специализированных трансформерных моделей и нейронных сетей различной архитектуры. Разработанный подход предполагает, что Uniform Resource Locator для запроса обрабатывается моделью URLBERT, обученной на структурных особенностях веб-адресов, тогда как содержимое запроса анализируется моделью SecRoBERT, ориентированной на задачи кибербезопасности. Полученные контекстные представления объединяются и передаются в параллельные блоки сверточной нейронной сети и многослойного перцептрона, обеспечивающие извлечение локальных и глобальных признаков соответственно. Предложенный подход позволяет объединить возможности трансформерных моделей обработки данных с эффективным выявлением статистических и локальных зависимостей на основе сверточной нейронной сети и многослойного перцептрона, что повышает точность классификации вредоносных запросов. Основные результаты. Экспериментальная оценка проведена на трех наборах данных, два из которых служат для бинарной классификации и один для многоклассовой. Тестирование проводилось с использованием k-fold кросс-валидации и посредством измерения задержки вывода модели, для демонстрации применимости метода в системах обнаружения атак в реальном времени. Результаты экспериментальной оценки предлагаемой модели продемонстрировали достаточно высокие показатели точности обнаружения атак на веб-приложения, а также показали существенный недостаток, связанный со значительным временем обработки запросов. Обсуждение. Анализ результатов тестирования и сравнение с релевантными исследованиями подтвердил целесообразность использования данной модели в качестве второго этапа анализа запросов в системах обнаружения атак на веб-приложения. 

Given the steady increase in the number of attacks on web applications, the task of automatically detecting such attacks requests remains one of the key challenges in information security. The aim of this work is to develop a new hybrid approach to detecting attacks on web applications in which the feature extraction stage is shifted to the level of pretrained transformers. To achieve this goal, the paper proposes a hybrid method for detecting attacks on web applications based on the combined use of specialized transformer models and neural networks of various architectures. The suggested approach offers that the request URL is processed by a URLBERT model trained on the structural features of web addresses, while the request content is analyzed by a SecRoBERT model tailored for cybersecurity tasks. The resulting contextual representations are combined and fed into parallel blocks of a convolutional neural network and a multilayer perceptron, which extract local and global features, respectively. The proposed approach combines the capabilities of transformer data processing models with the efficient identification of statistical and local dependencies based on a convolutional neural network and a multilayer perceptron, which improves the accuracy of malicious query classification. Experimental evaluation is conducted on three datasets, two of which are used for binary classification and one for multi-class classification. Testing was performed using k-fold cross-validation and by measuring the model output latency to demonstrate the method applicability in real-time attack detection systems. The results of the experimental evaluation of the proposed model demonstrate high accuracy in detecting attacks on web applications, but also reveal a significant drawback related to the considerable time required to process requests. Analysis of the test results and comparison with relevant studies confirm the feasibility of using this model as the second stage of request analysis in web application attack detection systems.

обнаружение атак на веб-приложенияинформационная безопасностьглубокое обучениетрансформерные моделиSQL-инъекцииXSS-атакиweb application attack detectioninformation securitydeep learningtransformer modelsSQL injectionXSS attacksРабота выполнена при поддержке гранта Российского научного фонда и Санкт-Петербургского научного фонда № 25-11-20028 (https://rscf.ru/project/25-11-20028/) в СПб ФИЦ РАН.This study was supported by the Russian Science Foundation and the Saint Petersburg Science Foundation (grant No. 25-11-20028, https://rscf.ru/project/25-11-20028/) in SPC RAS.ReferencesKaur D., Kaur P. Empirical analysis of Web attacks // Procedia Computer Science. 2016. V. 78. P. 298–306. doi: 10.1016/j.procs.2016.02.057Kaur D., Kaur P. Empirical analysis of Web attacks. Procedia Computer Science, 2016, vol. 78, pp. 298–306. doi: 10.1016/j.procs.2016.02.057Desnitsky V.A., Kotenko I.V., Nogin S.B. Detection of anomalies in data for monitoring of security components in the Internet of Things // Proc. of the XVIII International Conference on Soft Computing and Measurements (SCM). 2015. P. 189–192. doi: 10.1109/SCM.2015.7190452Desnitsky V.A., Kotenko I.V., Nogin S.B. Detection of anomalies in data for monitoring of security components in the Internet of Things. Proc. of the XVIII International Conference on Soft Computing and Measurements (SCM), 2015, pp. 189–192. doi: 10.1109/SCM.2015.7190452Dong H., Kotenko I. Cybersecurity in the AI era: analyzing the impact of machine learning on intrusion detection // Knowledge and Information Systems. 2025. V. 67. N 5. P. 3915–3966. doi: 10.1007/s10115-025-02366-wDong H., Kotenko I. Cybersecurity in the AI era: analyzing the impact of machine learning on intrusion detection. Knowledge and Information Systems, 2025, vol. 67, no. 5, pp. 3915–3966. doi: 10.1007/s10115-025-02366-wКотенко И.В., Соболев П.С. Обнаружение атак на веб-приложения на основе комбинирования сверточных нейронных сетей и многослойных перцептронов // Информатизация и связь. 2025. № 2. С. 90–96. doi: 10.34219/2078-8320-2025-16-2-90-96Kotenko I.V., Sobolev P.S. Detection of attacks on Web applications based on a combination of convolutional neural networks and multilayer perceptrons. Informatization and communication, 2025, no. 2, pp. 90-96. (in Russian). doi: 10.34219/2078-8320-2025-16-2-90-96Kotenko I., Abramenko G. Ontology-guided heterogeneous graph retrieval for large-language-model interpretation of Suricata events // Lecture Notes in Networks and Systems. 2026. V. 1762. P. 261–272. doi: 10.1007/978-3-032-13615-2_22Kotenko I., Abramenko G. Ontology-guided heterogeneous graph retrieval for large-language-model interpretation of Suricata events. Lecture Notes in Networks and Systems, 2026, vol. 1762, pp. 261-272. doi: 10.1007/978-3-032-13615-2_22Casmiry E.N., Sinde R.S., Mduma N.M. A Hybrid deep learning model for SQL injection attack detection // IEEE Access. 2026. V. 14. P. 6450–6463. doi: 10.1109/ACCESS.2026.3651991Casmiry E.N., Sinde R.S., Mduma N.M. A Hybrid deep learning model for SQL injection attack detection. IEEE Access, 2026, vol. 14, pp. 6450–6463. doi: 10.1109/ACCESS.2026.3651991Thalji N., Raza A., Islam M.S., Samee N.A., Jamjoom M.M. AE-Net: Novel autoencoder-based deep features for SQL injection attack detection // IEEE Access. 2023. V. 11. P. 135507–135516. doi: 10.1109/ACCESS.2023.3337645Thalji N., Raza A., Islam M.S., Samee N.A., Jamjoom M.M. AE-Net: Novel autoencoder-based deep features for SQL injection attack detection. IEEE Access, 2023, vol. 11, pp. 135507–135516. doi: 10.1109/ACCESS.2023.3337645Seyyar Y.E., Yavuz A.G., Ünver H.M. An attack detection framework based on BERT and deep learning // IEEE Access. 2022. V. 10. P. 68633–68644. doi: 10.1109/ACCESS.2022.3185748Seyyar Y.E., Yavuz A.G., Ünver H.M. An attack detection framework based on BERT and deep learning. IEEE Access, 2022, vol. 10, pp. 68633–68644. doi: 10.1109/ACCESS.2022.3185748Odumuyiwa V., Chibueze A. Automatic detection of HTTP injection attacks using convolutional neural network and deep neural network // Journal of Cyber Security and Mobility. 2021. V. 9. N 4. P. 489–514. doi: 10.13052/jcsm2245-1439.941Odumuyiwa V., Chibueze A. Automatic detection of HTTP injection attacks using convolutional neural network and deep neural network. Journal of Cyber Security and Mobility, 2021, vol. 9, no. 4, pp. 489-514. doi: 10.13052/jcsm2245-1439.941Li J., Fu Y., Xu J., Ren C., Xiang X., Guo J. Web application attack detection based on attention and gated convolution networks // IEEE Access. 2020. V. 8. P. 20717–20724. doi: 10.1109/ACCESS.2019.2955674Li J., Fu Y., Xu J., Ren C., Xiang X., Guo J. Web application attack detection based on attention and gated convolution networks. IEEE Access, 2020, vol. 8, pp. 20717–20724. doi: 10.1109/ACCESS.2019.2955674Muduli D., Shookdeb S., Zamani A.T., Saxena S., Kanade A.S., Parveen N., Shameem M. SIDNet: A SQL Injection detection network for enhancing cybersecurity // IEEE Access. 2024. V. 12. P. 176511176526. doi: 10.1109/ACCESS.2024.3502293Muduli D., Shookdeb S., Zamani A.T., Saxena S., Kanade A.S., Parveen N., Shameem M. SIDNet: A SQL Injection detection network for enhancing cybersecurity. IEEE Access, 2024, vol. 12, pp. 176511-176526. doi: 10.1109/ACCESS.2024.3502293Demirel D.Y., Sandikkaya M.T. Web based anomaly detection using zero-shot learning with CNN // IEEE Access. 2023. V. 11. P. 9151191525. doi: 10.1109/ACCESS.2023.3303845Demirel D.Y., Sandikkaya M.T. Web based anomaly detection using zero-shot learning with CNN. IEEE Access, 2023, vol. 11, pp. 91511-91525. doi: 10.1109/ACCESS.2023.3303845Ferrag M.A., Ndhlovu M., Tihanyi N., Cordeiro L.C., Debbah M., Lestable T., et al. Revolutionizing cyber threat detection with large language models: a privacy-preserving BERT-based lightweight model for IoT/IIoT devices // IEEE Access. 2024. V. 12. P. 23733-23750. doi: 10.1109/ACCESS.2024.3363469Ferrag M.A., Ndhlovu M., Tihanyi N., Cordeiro L.C., Debbah M., Lestable T., et al. Revolutionizing cyber threat detection with large language models: a privacy-preserving BERT-based lightweight model for IoT/IIoT devices. IEEE Access, 2024, vol. 12, pp. 23733-23750. doi: 10.1109/ACCESS.2024.3363469Tang P., Qiu W., Huang Z., Lian H., Liu G. Detection of SQL injection based on artificial neural network // Knowledge-Based Systems. 2020. V. 190. P. 105528. doi: 10.1016/j.knosys.2020.105528Tang P., Qiu W., Huang Z., Lian H., Liu G. Detection of SQL injection based on artificial neural network. Knowledge-Based Systems, 2020, vol. 190, pp. 105528. doi: 10.1016/j.knosys.2020.105528Mokbal F.M.M., Wang D., Imran A., Lin J., Akhtar F., Wang X. MLPXSS: An Integrated XSS-based attack detection scheme in Web applications using multilayer perceptron technique // IEEE Access. 2019. V. 7. P. 100567–100580. doi: 10.1109/ACCESS.2019.2927417Mokbal F.M.M., Wang D., Imran A., Lin J., Akhtar F., Wang X. MLPXSS: An Integrated XSS-based attack detection scheme in Web applications using multilayer perceptron technique. IEEE Access, 2019, vol. 7, pp. 100567–100580. doi: 10.1109/ACCESS.2019.2927417Xie X., Ren C., Fu Y., Xu J., Guo J. SQL injection detection for Web applications based on elastic-pooling CNN // IEEE Access. 2019. V. 7. P. 151475–151481. doi: 10.1109/ACCESS.2019.2947527Xie X., Ren C., Fu Y., Xu J., Guo J. SQL injection detection for Web applications based on elastic-pooling CNN. IEEE Access, 2019, vol. 7, pp. 151475–151481. doi: 10.1109/ACCESS.2019.2947527Tian Z., Luo C., Qiu J., Du X., Guizani M. A Distributed deep learning system for Web attack detection on edge devices // IEEE Transactions on Industrial Informatics. 2020. V. 16. N 3. P. 1963-1971. doi: 10.1109/TII.2019.2938778Tian Z., Luo C., Qiu J., Du X., Guizani M. A Distributed deep learning system for Web attack detection on edge devices. IEEE Transactions on Industrial Informatics, 2020, vol. 16, no. 3, pp. 1963–1971. doi: 10.1109/TII.2019.2938778El Mahdaouy A., Lamsiyah S., Idrissi M.J., Alami H., Yartaoui Z., Berrada I. DomURLs_BERT: Pre-trained BERT-based model for malicious domains and URLs detection and classification // Journal of Network and Systems Management. 2026. V. 34. N 2. P. 36. doi: 10.1007/s10922-025-10010-9El Mahdaouy A., Lamsiyah S., Idrissi M.J., Alami H., Yartaoui Z., Berrada I. DomURLs_BERT: Pre-trained BERT-based model for malicious domains and URLs detection and classification. Journal of Network and Systems Management, 2026, vol. 34, no. 2, pp. 36. doi: 10.1007/s10922-025-10010-9Bacevicius M., Paulauskaite-Taraseviciene A., Zokaityte G., Kersys L., Moleikaityte A. Comparative analysis of perturbation techniques in LIME for intrusion detection enhancement // Machine Learning and Knowledge Extraction. 2025. V. 7. N 1. P. 21. doi: 10.3390/make7010021Bacevicius M., Paulauskaite-Taraseviciene A., Zokaityte G., Kersys L., Moleikaityte A. Comparative analysis of perturbation techniques in LIME for intrusion detection enhancement. Machine Learning and Knowledge Extraction, 2025, vol. 7, no. 1, pp. 21. doi: 10.3390/make7010021Bacevicius M., Paulauskaite-Taraseviciene A. Machine learning algorithms for raw and unbalanced intrusion detection data in a multiclass classification problem // Applied Sciences. 2023. V. 13. N 12. P. 7328. doi: 10.3390/app13127328Bacevicius M., Paulauskaite-Taraseviciene A. Machine learning algorithms for raw and unbalanced intrusion detection data in a multiclass classification problem. Applied Sciences, 2023, vol. 13, no. 12, pp. 7328. doi: 10.3390/app13127328Котенко И.В., Соболев П.С. Обнаружение атак на веб-приложения: анализ современных подходов // Актуальные проблемы инфотелекоммуникаций в науке и образовании: Сборник научных статей XIII Международной научно-технической и научно-методической конференции. 2024. Т. 1. P. 497–501.Kotenko I.V., Sobolev P.S. Detection of attacks on Web applications: analysis of modern approaches. Proc. of the Actual Problems of Infotelecommunications in Science and Education (APINO 2024), 2024, vol. 1, pp. 497–501. (in Russian)Еремин Е.О. Обзор открытых наборов данных для выявления атак на веб-приложения // International Journal of Open Information Technologies. 2024. Т. 12. № 3. С. 106–113.Eremin E. Verview of public datasets for Web application attack detecting. International Journal of Open Information Technologies, 2024, vol. 12, no. 3, pp. 106–113. (in Russian)Venkatramulu S., Waseem Md.S., Taneem A., Thoutam S.Y., Apuri S., Nachiketh. Research on SQL injection attacks using word embedding techniques and machine learning // Journal of Sensors, IoT & Health Sciences. 2024. V. 2. N 1. P. 55–64. doi: 10.69996/jsihs.2024005Venkatramulu S., Waseem Md.S., Taneem A., Thoutam S.Y., Apuri S., Nachiketh. Research on SQL injection attacks using word embedding techniques and machine learning. Journal of Sensors, IoT & Health Sciences, 2024, vol. 2, no. 1, pp. 55–64. doi: 10.69996/jsihs.2024005Bakır R. UniEmbed: A Novel approach to detect XSS and SQL injection attacks leveraging multiple feature fusion with machine learning techniques // Arabian Journal for Science and Engineering. 2025. V. 50. N 19. P. 15591–15604. doi: 10.1007/s13369-024-09916-4Bakır R. UniEmbed: A Novel approach to detect XSS and SQL injection attacks leveraging multiple feature fusion with machine learning techniques. Arabian Journal for Science and Engineering, 2025, vol. 50, no. 19, pp. 15591–15604. doi: 10.1007/s13369-024-09916-4Karacan H., Sevri M. A Novel data augmentation technique and deep learning model for Web application security // IEEE Access. 2021. V. 9. P. 150781–150797. doi: 10.1109/ACCESS.2021.3125785Karacan H., Sevri M. A Novel data augmentation technique and deep learning model for Web application security. IEEE Access, 2021, vol. 9, pp. 150781–150797. doi: 10.1109/ACCESS.2021.3125785Yang W., Zuo W., Cui B. Detecting malicious URLs via a keywordbased convolutional gated-recurrent-unit neural network // IEEE Access. 2019. V. 7. P. 29891–29900. doi: 10.1109/ACCESS.2019.2895751Yang W., Zuo W., Cui B. Detecting malicious URLs via a keywordbased convolutional gated-recurrent-unit neural network. IEEE Access, 2019, vol. 7, pp. 29891–29900. doi: 10.1109/ACCESS.2019.2895751

The authors declare that there are no conflicts of interest present.