Signature-based detection remains the predominant approach in commercial WAFs. ModSecurity’s Core Rule Set (CRS) employs over 200 curated regular expressions targeting known injection patterns [1]. While achieving high precision on canonical attack vectors, these systems suffer from two critical limitations i.e., zero-day vulnerability, where novel attack patterns require manual rule updates, and evasion susceptibility, where automated tools such as SQLMap [8] and WAFNinja [9] systematically generate bypass payloads through encoding permutations, case manipulation, and comment injection.

Early ML approaches employed traditional algorithms such as Logistic Regressions, Random Forests, Naive Bayes and Support Vector Machines operating on features that are manually crafted such as n-gram frequencies and character distribution [10][11]. While effective on clean datasets, these methods require extensive feature engineering and do not generalize well to novel attack variants.

Deep learning approaches have progressively improved detection capabilities. The authors in [12] demonstrated that BERT-LSTM networks achieve 97.3% accuracy on SQLi detection by extracting sentence-level and word features, then generating embedding vectors that identify malicious SQL query patterns. In [13], researchers applied attention mechanisms to identify salient payload regions, improving interpretability. However, these approaches operate at the word or sub-word level, leaving room for complementary character-level analysis to capture fine-grained morphological patterns associated with obfuscation techniques.

BERT (Bidirectional Encoder Representations from Transformers) [14] has been adapted for various security tasks including malware classification, phishing detection, and vulnerability identification [15]. However, standard BERT architectures impose a 512-token context limit, insufficient for analyzing verbose HTTP requests or multi-stage injection payloads that may span thousands of characters.

ModernBERT [7] released in late 2024, addresses these limitations through architectural innovations including Flash Attention [16] for memory-efficient O(N) attention computation, Alternating Attention interleaving local sliding window attention (128 tokens) with global attention layers, and Rotary Positional Embeddings (RoPE) [17] enabling extrapolation to 8192 tokens. These advances make ModernBERT particularly suitable for security applications requiring analysis of complete HTTP requests including headers, cookies, and body content, while maintaining the inference speed necessary for real-time deployment.

Character-level CNNs do not require tokenization to achieve good performance on text classification tasks, learning hierarchical representations directly from raw character sequences. Subsequent work demonstrated their effectiveness in detecting the morphological signatures of malicious content, such as anomalous character distributions, encoding patterns, and structural irregularities, that may be invisible to word-level models [18].

Multi-modal fusion architectures have shown promise in combining complementary feature representations. Kim et al. [19] proposed concatenating word embeddings with character-level CNN features for sentiment analysis, achieving improvements over single-modality baselines. Our work extends this paradigm to the security domain, specifically targeting the unique challenges of injection attack detection.

An adversary is considered attempting to exploit web application vulnerabilities through injection attacks embedded in HTTP request components (URL parameters, POST body, headers, cookies). The adversary possesses:

Knowledge of target application: Understanding of backend database systems (MySQL, PostgreSQL, etc.) and client-side scripting contexts.Evasion capabilities: Access to automated obfuscation tools capable of generating encoding variants, comment injection, case manipulation, and other bypass techniques.Obfuscation tooling: Access to publicly available evasion tools and encoding techniques to generate obfuscated payload variants prior to deployment.

The defender deploys an inline detection system that must classify each incoming HTTP request as benign or malicious within strict latency constraints (<50 ms) while minimizing both false negatives (missed attacks) and false positives (blocked legitimate traffic).

Given an HTTP payload x represented as a character sequence x = ( c 1 , c 2 , ⋯ , c n ) where c i ∈ Σ (ASCII character set), the detection task is formulated as binary classification as shown in Equation (1):

where fis the learned classifier, 0 denotes benign traffic, and 1 denotes malicious injection attempt. The objective is to learn f that maximizes detection rate (recall) while constraining false positive rate below operational thresholds.

The semantic branch leverages ModernBERT-base to capture contextual understanding of payload intent.

Input Processing: The raw payload string is tokenized using the ModernBERT tokenizer with maximum sequence length L_max = 512 tokens. We select this limit because empirical analysis shows that over 99% of HTTP payloads in our dataset fall within 512 tokens, balancing computational efficiency with coverage. The underlying ModernBERT architecture supports up to 8192 tokens, allowing seamless scaling for applications requiring analysis of verbose multi-part requests. Payloads exceeding the configured limit are truncated with a warning logged for analysis.

Model Architecture: ModernBERT-base comprises 22 Transformer layers with hidden dimension d = 768, 12 attention heads, and intermediate feed-forward dimension 3072.

Feature Extraction: The final hidden state associated with the [CLS] token is extracted and used as the semantic representation, as expressed in Equation (2).

This vector encodes the aggregate semantic content of the payload, capturing high-level patterns such as “query attempting data retrieval” or “script injection targeting DOM manipulation”.

The syntactic branch employs a 1D Convolutional Neural Network operating directly on character sequences to detect morphological attack signatures.

Input Processing: Each character in the payload is mapped to its ASCII integer value c i ∈ { 0 , 1 , ⋯ , 255 } . The input sentences are padded if less or truncated if they exceed the maximum to fixed length L c h a r = 1024 characters.

Architecture Details:Table 1 lists the layer configuration of the character-level CNN branch.

Feature Extraction:Global max pooling extracts the most salient activation

Table 1.Character-level CNN architecture.

across the sequence:

This representation captures character-level signatures including high density of special characters (%, ', <, >), encoding patterns indicative of obfuscation, and structural anomalies such as nested brackets or comment sequences.

The semantic and syntactic representations are concatenated to form a unified feature vector:

This fused representation passes through a classification head:

where W 1 ∈ ℝ 256 × 896 , W 2 ∈ ℝ 2 × 256 are learned weight matrices.

Weighted cross-entropy loss is used as the loss function. This is used in consideration of class imbalance and prioritize attack detection:

where w 0 = 1.0 (benign) and w 1 = 2.5 (attack), penalizing false negatives more heavily than false positives given the asymmetric cost of missed attacks in security applications.

The two branches are trained end-to-end jointly. To accommodate the different convergence rates of pre-trained (ModernBERT) and randomly-initialized (CNN) components, we employ differential learning rates η B E R T = 2 × 10 − 5 η C N N = 1 × 10 − 3 . To prevent exploding gradients, Gradient clipping with max norm = 1.0 is used during early training.

To ensure broad coverage of real-world attack patterns and minimize dataset bias, we constructed a composite dataset by aggregating HTTP injection payloads and benign traffic from four complementary sources. Table 2 summarizes the dataset composition.

Source 1: Public Repositories (GitHub): We curated malicious payloads from widely-used open-source collections including payloadbox/sql-injection-payload-list [20], payloadbox/xss-payload-list [21], and swisskyrepo/PayloadsAllThe Things [22]. After deduplication and normalization, this source contributed approximately 18,000 unique SQLi and XSS payloads spanning classic injection vectors, filter bypass techniques, and polyglot payloads.

Source 2: OWASP Resources: Additional attack samples were drawn from the OWASP Testing Guide payload corpus and the OWASP Web Security Testing Guide’s injection test cases [1]. These payloads reflect structured, expert-curated attack taxonomies and contributed approximately 6500 samples covering SQLi, XSS, LDAP Injection, and OS Command Injection vectors.

Source 3: Synthetic Generation on Vulnerable Applications: To capture realistic attack traffic with full HTTP context (headers, cookies, session state), we deployed DVWA (Damn Vulnerable Web Application) [23] and OWASP Juice Shop [24] in isolated Docker environments and executed automated attack campaigns using SQLMap [8] with tamper scripts for case swapping, comment injection, encoding variations, and keyword fragmentation and XSStrike for context-aware XSS payload generation with DOM analysis. All HTTP traffic was routed through Burp Suite [25] configured as an intercepting proxy, which logged complete request/response pairs including headers, cookies, and body content. This pipeline generated approximately 12,000 attack requests with authentic HTTP structure and session context, including obfuscated variants produced by SQLMap’s tamper modules (e.g., between, charencode, space2comment, randomcase).

Source 4: Live Honeypot Traffic: To incorporate genuine attacker behavior observed in the wild, we deployed a T-Pot honeypot platform [26] on a public-facing VPS (4 vCPU, 8GB RAM) with its web application honeypot components SNARE [27] acting as the vulnerability-emulating HTTP sensor and Tanner [28] the backend analysis engine that classifies and logs incoming attacks. The honeypot was exposed on standard HTTP/HTTPS ports of 80 and 443 respectively for a period of 90 days, during which it captured approximately 22,000 malicious HTTP requests originating from automated scanners, botnets, and manual exploitation attempts. This source provides ecological validity, reflecting attack distributions and obfuscation strategies encountered in production environments.

Benign Traffic Collection: Legitimate HTTP traffic was collected by simulating realistic user browsing sessions on various web applications including WordPress-based sites, the OWASP Juice Shop and a custom e-commerce application using Playwright browser automation [29]. Scripts emulated diverse user behaviors, including form submissions, search queries, navigation, file uploads, and AJAX interactions, across multiple browser profiles with varying user agents and session patterns. HTTP request logs were captured via Playwright’s network interception API, yielding approximately 35,000 benign requests with natural parameter distributions and header structures. All collected requests were normalized to a canonical format preserving the raw payload string alongside metadata (HTTP method, content type, source label). Duplicate payloads were removed. Table 2 and Figure 2 summarize the dataset composition and class distribution.

Labelling Protocol:Samples were labeled according to their collection route and verification context. Payloads from curated public repositories and OWASP

Table 2.Dataset composition by source.

Figure 2. Dataset composition by source and class distribution. The left panel shows the number of samples contributed by each collection source. The right panel illustrates the overall malicious-to-benign class ratio.

resources were labeled malicious according to their documented attack category. Traffic generated by SQLMap and XSStrike against intentionally vulnerable DVWA and OWASP Juice Shop instances was labeled malicious because the tools generated known attack attempts in a controlled environment. The collected Tanner HTTP honeypot logs were processed using a custom Python script, which parsed the raw logs and converted them into a structured event dataset. The script normalized the request fields, removed duplicate records using a deterministic SHA-256 fingerprint generated from selected request fields, and extracted features from the URL path, payload body, headers, user-agent, referer, and request method. Initial labeling was carried out using a rule-based weak-labeling protocol designed for injection and exploit detection, where each event was checked for indicators such as SQL injection patterns, command injection terms, path traversal sequences, file inclusion attempts, XSS-like payloads, shell-related keywords, encoded traversal strings, .env, .git, phpunit, /etc/passwd, and suspicious PHP or WordPress exploit paths. Events matching these indicators were labeled as attack-related, with the specific attack type assigned where a recognizable injection pattern was present, while repeated non-browser-like requests from the same IP within short time windows were labeled as scanner activity, lower-confidence suspicious requests were labeled as probes, browser-like requests with no suspicious indicators were labeled as benign, and unmatched events were marked as unknown. These weak labels were then treated as preliminary labels and transitioned toward ground truth through manual validation, where the request paths, payloads, headers, methods, user-agents, and source behavior were reviewed against predefined annotation criteria. Labels were confirmed when the request evidence clearly matched the assigned class, corrected when a rule-based label was inaccurate, and marked as unknown or ambiguous when the available evidence was insufficient. This process produced a reproducible and more reliable labeled dataset for injection-attack detection, with each final label supported by explicit behavioral or payload-based evidence.

After deduplication, the composite dataset comprised 93,500 samples in total: 35,000 benign requests collected via Playwright browsing simulation and 58,500 malicious requests. Among the malicious samples, the documented attack-family distribution was 30,800 SQL injection cases (from GitHub repositories, OWASP resources, SQLMap campaigns, and T-Pot/Tanner honeypot logs), 18,500 cross-site scripting cases (GitHub, OWASP, XSStrike, and T-Pot/Tanner), 4800 OS command injection cases (OWASP, synthetic generation, and T-Pot/Tanner), 2450 LDAP injection cases (primarily OWASP and curated sources), and 2950 XML/XPath injection cases (OWASP, curated lists, and honeypot traffic). Attack-family labels were used only for dataset characterization and analysis, model training and evaluation used binary benign versus malicious labels.

Deduplication and Leakage Control: Deduplication and partition assignment were performed before model training on the normalized payload/request text used as model input. Exact duplicate strings were removed first. To limit train/test leakage from obfuscated or transformed variants of the same underlying payload, each sample was mapped to a canonical form by iteratively applying safe URL and HTML entity decoding (up to three passes, stopping when the string no longer changed), lowercasing case-insensitive tokens, and normalizing whitespace and common SQL comment artifacts. A SHA-256 hash of the canonical string was computed for each sample and used as a group identifier. All samples sharing the same hash were treated as one group and assigned wholly to a single partition so that encoding, case, or comment variants of the same base payload could not appear in both training and evaluation subsets.

Dataset Split: The dataset was divided into 70% training data while 15% was used for validation during experiments, and 15% for testing subsets using stratified sampling to preserve the class distribution across all splits to ensure proportional representation of attack types and data sources across splits.

We compared against a baseline set spanning one rule-based system, one classical ML model, one character-level neural model, one ModernBERT-only semantic model, and the proposed hybrid architecture. These baselines are summarized in Table 3.

Table 3.Baseline models evaluated in this study.

Table 4 lists the software stack, optimization settings, and hardware used for model training and fine-tuning.

Table 4.Training configuration and compute environment.

Standard classification metrics are reported with particular emphasis on security-relevant measures:

AUC-ROC:The area beneath the ROC curve, used to evaluate the model’s ability to distinguish between attack and benign samples across different classification thresholds.

Table 5 summarizes the performance results of all evaluated models on the combined test set. Figure 3 shows the confusion matrix for the Hybrid model using the held-out test set.

Table 5.Comparison of the performance on the composite multi-source test set.

Figure 3. Confusion matrix for the Hybrid model on the test set (n = 14,025). The model correctly classifies 5176 benign and 8693 malicious requests, with only 78 false positives and 78 false negatives.

Key Observations:

1) Rule-based limitations: ModSecurity achieves high precision (95.2%) but suffers from poor recall (62.1%), missing 38% of attacks, particularly obfuscated variants absent from its signature database.

2) Semantic model advantage: ModernBERT outperforms the classical ML and character-only baselines, validating the value of strong contextual representations for security classification.

3) Hybrid synergy:The proposed dual-stream architecture achieved the best performance across all evaluation metrics. Compared with the standalone ModernBERT model, it improved accuracy by 2.4%, corresponding to a 65% reduction in the overall error rate.

4) FPR trade-off considerations: Even at 1.5% FPR, deployment in high-volume settings would still require threshold selection aligned with the desired balance between alert volume and recall. The model’s high AUC-ROC (0.996) provides flexibility for this trade-off. For example, raising the threshold to 0.95 reduces the FPR below 0.5% with only marginal recall degradation.

6.1.1. Random-Seed Stability

We evaluated run-to-run consistency by training the main neural models with three random seeds (42, 123, and 2024) and reporting the mean and standard deviation of the main metrics. As shown in Table 6, the Hybrid model remained consistently above the ModernBERT-only and CharacterCNN-only models across seeds, with lower variation and a higher mean F1-score.

Table 6.Random-seed stability of the main neural models on the held-out test set across three training runs using seeds 42, 123, and 2024.

6.1.2. Source-Wise Robustness Evaluation

To assess whether the hybrid model relied on collection-source artifacts rather than general injection patterns, we evaluated the same trained model and validation-selected decision threshold on disjoint subsets of the held-out test set defined by collection source. Source labels were not used as model inputs. As shown in Table 7, performance remained high across GitHub repositories, OWASP resources, synthetic DVWA/Juice Shop campaigns, and live T-Pot honeypot traffic, with F1-scores between 97.3% and 99.0% on malicious subsets. The lowest recall (96.9%) occurred on T-Pot honeypot traffic, which is expected given noisier wild scanner behaviour, while Playwright benign traffic achieved 99.2% accuracy with a false-positive rate of 0.8%, indicating limited over-blocking of legitimate browsing sessions. These results suggest that gains are not driven by a single repository format alone.

Table 7. Source-wise hybrid model performance on the held-out test set.

6.1.3. Threshold Selection and Inference Latency

To assess deployment suitability in an offline evaluation setting, we selected the decision threshold using only the validation set rather than the test set. Attack-probability thresholds were swept, and the validation-selected operating point was chosen to satisfy the target false-positive-rate constraint while preserving high recall. The selected threshold was then frozen before final evaluation on the held-out test set. At the validation-selected threshold of 0.95, the validation false-positive rate was below 0.5% and the validation recall remained above 98%; on the held-out test set, the false-positive rate was also below 0.5%. Inference latency was measured with batch size 1 on an NVIDIA A100 40GB GPU, with a mean latency of 12.3 ms/request, P95 latency of 15.9 ms/request, and P99 latency of 21.4 ms/request. These offline inference latencies are below the stated 50 ms/request inline-detection target. However, the latency values correspond to the model forward pass only and do not include request parsing, preprocessing/tokenization, CPU-GPU transfer, network overhead, or gateway integration costs. Therefore, they should not be interpreted as end-to-end production gateway latency.

To isolate the contribution of each branch, we evaluated models on stratified subsets with varying obfuscation complexity. Table 8 present the results across

Table 8.Performance breakdown by obfuscation level (Accuracy/F1-Score).

Analysis: ModernBERT excels on clean payloads where semantic patterns are preserved but degrades on heavily obfuscated inputs. Conversely, the Character-CNN maintains consistent performance across obfuscation levels, actually improving slightly on obfuscated data due to the distinctive character distributions introduced by encoding transformations. The hybrid model inherits the strengths of both branches, achieving good performance across all conditions.

three obfuscation levels. Obfuscation levels were defined by the number of active encoding and evasion transformations applied to each payload. Clean payloads contain no encoding. Light obfuscation includes a single transformation such as URL encoding, HTML entity substitution, or case randomization. Heavy obfuscation includes two or more stacked transformations, e.g., double URL encoding with inline comment insertion. This stratification was applied before the train/validation/test split to ensure proportional representation across splits.