Enhanced Web Payload Classification Using WAMM: An AI-Based Framework for Dataset Refinement and Model Evaluation

2025-12-29

AI Summary

Traditional static-rule Web Application Firewalls (WAFs) suffer from poor robustness against obfuscated, polymorphic, and zero-day web attacks and require labor-intensive manual tuning. To address these limitations, this paper proposes WAMM: a novel LLM-augmented multi-stage data refinement framework—featuring deduplication, relabeling, realism enhancement, and filtering—to expose inherent weaknesses in rule-based engines. WAMM further introduces a technology-stack-aligned multi-class reclassification architecture that balances real-time inference with high accuracy. Evaluated on the enhanced SR-BH 2020 dataset, the XGBoost variant achieves 99.59% accuracy with microsecond-level latency. Against the OWASP Core Rule Set (CRS), WAMM attains 96–100% true positive detection rates—up to 86% higher than baseline methods—demonstrating substantial improvements in both coverage and precision for modern web attack mitigation.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Application Domains: Web
• Data Mining & Knowledge Management: Web

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Search and Retrieval-Augmented AI: Efficiency and scalability of Web search engines
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Web applications increasingly face evasive and polymorphic attack payloads, yet traditional web application firewalls (WAFs) based on static rule sets such as the OWASP Core Rule Set (CRS) often miss obfuscated or zero-day patterns without extensive manual tuning. This work introduces WAMM, an AI-driven multiclass web attack detection framework designed to reveal the limitations of rule-based systems by reclassifying HTTP requests into OWASP-aligned categories for a specific technology stack. WAMM applies a multi-phase enhancement pipeline to the SR-BH 2020 dataset that includes large-scale deduplication, LLM-guided relabeling, realistic attack data augmentation, and LLM-based filtering, producing three refined datasets. Four machine and deep learning models are evaluated using a unified feature space built from statistical and text-based representations. Results show that using an augmented and LLM-filtered dataset on the same technology stack, XGBoost reaches 99.59% accuracy with microsecond-level inference while deep learning models degrade under noisy augmentation. When tested against OWASP CRS using an unseen augmented dataset, WAMM achieves true positive block rates between 96 and 100% with improvements of up to 86%. These findings expose gaps in widely deployed rule-based defenses and demonstrate that curated training pipelines combined with efficient machine learning models enable a more resilient, real-time approach to web attack detection suitable for production WAF environments.

Problem

• Detect evasive web attacks using AI instead of static rules
• Refine datasets with LLM-guided labeling and augmentation
• Evaluate models for real-time detection in WAF environments

Innovation

• AI-driven multiclass framework reclassifies HTTP requests
• Multi-phase dataset enhancement with LLM-guided relabeling
• Unified feature space evaluation boosts detection accuracy