🤖 AI Summary
Traditional web application firewalls (WAFs) suffer from high false-positive rates due to their inability to accurately distinguish malicious traffic from legitimate requests. To address this, this paper proposes an adaptive two-tier machine learning–based WAF architecture. The architecture employs a cascaded decision tree for anomaly detection followed by a support vector machine for fine-grained threat classification, integrated with comprehensive feature engineering and data preprocessing. It is trained and validated on five publicly available benchmark datasets. Compared to single-model approaches, the collaborative two-tier design significantly enhances discrimination capability: achieving an average detection accuracy of 99.88%, perfect precision (100%), and substantially reduced false positives. The core innovation lies in decoupling and cascading anomaly detection and attack-type classification—enabling both real-time responsiveness and granular threat identification. This framework provides a reproducible, robust, and scalable pathway toward intelligent WAF evolution.
📝 Abstract
Web Application Firewalls are crucial for protecting web applications against a wide range of cyber threats. Traditional Web Application Firewalls often struggle to effectively distinguish between malicious and legitimate traffic, leading to limited efficacy in threat detection. To overcome these limitations, this paper proposes an Adaptive Dual-Layer WAF employing a two-layered Machine Learning model designed to enhance the accuracy of anomaly and threat detection. The first layer employs a Decision Tree (DT) algorithm to detect anomalies by identifying traffic deviations from established normal patterns. The second layer employs Support Vector Machine to classify these anomalies as either threat anomalies or benign anomalies. Our Adaptive Dual Layer WAF incorporates comprehensive data pre-processing and feature engineering techniques and has been thoroughly evaluated using five large benchmark datasets. Evaluation using these datasets shows that ADL WAF achieves a detection accuracy of 99.88% and a precision of 100%, significantly enhancing anomaly detection and reducing false positives. These findings suggest that integrating machine learning techniques into WAFs can substantially improve web application security by providing more accurate and efficient threat detection.