An Attack Detection Framework Based on BERT and Deep Learning

Abstract

Deep Learning (DL) and Natural Language Processing (NLP) techniques are improving and enriching with a rapid pace. Furthermore, we witness that the use of web applications is increasing in almost every direction in parallel with the related technologies. Web applications encompass a wide array of use cases utilizing personal, financial, defense, and political information (e.g., wikileaks incident). Indeed, to access and to manipulate such information are among the primary goals of attackers. Thus, vulnerability of the information targeted by adversaries is a vital problem and if such information is captured then the consequences can be devastating, which can, potentially, become national security risks in the extreme cases. In this study, as a remedy to this problem, we propose a novel model that is capable of distinguishing normal HTTP requests and anomalous HTTP requests. Our model employs NLP techniques, Bidirectional Encoder Representations from Transformers (BERT) model, and DL techniques. Our experimental results reveal that the proposed approach achieves a success rate over 99.98% and an F1 score over 98.70% in the classification of anomalous and normal requests. Furthermore, web attack detection time of our model is significantly lower (i.e., 0.4 ms) than the other approaches presented in the literature.

Securing 5G/6G IoT Using Transformer and Personalized Federated Learning: An Access-Side Distributed Malicious Traffic Detection Framework

“…Kozik et al [35] and Lin et al [36] proposed transformer-based models to process traffic traces and distinguish anomalous traffic from normal traffic. Seyyar et al [37] combined the multi-layer perceptron (MLP) with the BERT [27]-like input embedding method and proposed an abnormal HTTP request detection method. The experimental results showed that these methods achieved better performance for malicious traffic detection than others.…”

A survey on artificial intelligence techniques for security event correlation: models, challenges, and opportunities

“…The results illustrate that the ELMo representation can better illustrate the contextual-temporal dynamics in event prediction. BERT (Bidirectional Encoder Representations from Transformers) is actively used not only in the processing of natural, but also synthetic languages, such as HTTP/HTTPS for attack detection in network traffic (Seyyar et al, 2022). BERT models also allow learning the context of event log keys in anomaly detection systems LAnoBERT (Lee et al, 2021) and LogBERT (Guo et al, 2021).…”

“…• Rule-based correlation models -similarity rules (SimR) (Kotenko et al, 2020), causal rules (CauR) (Mahdavi et al, 2020;Siddiqui and Boukerche, 2021), composite rules (ComR) (Tao et al, 2021) and rule mining models (RM) (Xie et al, 2018;Bénard et al, 2021). • Semantic correlation models -signature language-based (SigL) (Almseidin et al, 2019;Tidjon et al, 2020), event embedding (EE) (Lee et al, 2021;Seyyar et al, 2022), and ontology learning (OL) (Zheng et al, 2018;Deng and Hooi, 2021) models. • Graphical correlation models -knowledge provenance graphs (KPG) (Milajerdi et al, 2019;Zeng et al, 2021), and probabilistic graphical models (PGM) (Shawly et al, 2019;Ma et al, 2022).…”

Detection of Wastewater Pollution Through Natural Language Generation With a Low-Cost Sensing Platform

“…Furthermore, they have been used with a similar technique for the task of human mobility forecasting [23], [24]. More in general, transformerbased models originally designed for NLP tasks have demonstrated successful applications in a wide variety of non-NLP tasks [25], including: images [26], [27], [28], videos [29], [30], [31], speech and audio recognition [32], [33], conversational systems [34], [35], recommender systems [36], [37], reinforcement learning [38], [39], graphs [40], [41], protein structure predictions [42], [43], autonomous driving [44], [45], and anomaly detection problems [46], [47].…”