Achieving Interpretable DL-based Web Attack Detection through Malicious Payload Localization

Achieving Interpretable DL-based Web Attack Detection through Malicious Payload Localization

Speakers: Peiyang Li (presented by Jen on behalf of the authors)

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=HBzO3UwE5vE

Overview

This talk presents a novel interpretability framework for deep learning-based web attack detection that goes beyond binary classification (normal/abnormal) to identify the exact location of malicious payloads within HTTP requests. While DL-based web attack detectors achieve advantages over traditional rule-based WAFs (Web Application Firewalls) -- eliminating manual rule misconfiguration and detecting unknown attacks -- they produce opaque results that require security operators to spend significant time analyzing flagged requests. The framework addresses this by quantifying the importance of individual HTTP request fields to pinpoint where the malicious payload resides.

The system uses a three-module pipeline: embedding attribution via gradient-based analysis, HTTP structure alignment to map importance scores to protocol fields, and malicious payload localization using a lightweight classifier. Evaluation across multiple datasets shows F1 scores approaching 1.0 for payload localization. A practical application demonstrates that localized payloads can be clustered and converted into WAF rules, improving detection recall by up to 26% (from 0.274 to 0.934 on the FPA dataset).

Background

▶ Watch: Web attack threats and DL-based detection limitations (0:00)

Web attacks -- SQL injection, cross-site scripting, Log4j exploitation -- remain among the most prevalent security threats. Attackers craft malicious payloads in specific fields of HTTP requests to exploit vulnerabilities in web applications. Deep learning-based detection methods have emerged as improvements over traditional rule-based Web Application Firewalls (WAFs), offering better coverage of unknown attacks and eliminating the problem of manual rule misconfiguration.

However, current DL-based approaches output only binary labels (normal or abnormal) without explaining which part of the request is malicious or what type of attack it represents. This lack of interpretability creates two practical problems: security operators must spend significant time manually analyzing detected attacks, and the opaque results erode operator trust in the detection system's effectiveness.

Existing interpretability frameworks for deep learning (such as LIME or SHAP) are designed for numerical features and do not account for the well-defined structure of HTTP requests. HTTP requests contain multiple fields (method, URI, headers, body, parameters) with distinct semantic roles. Generic interpretability methods that analyze numerical embeddings provide little insight into the actual maliciousness of specific request components.

The work was conducted jointly by researchers at Tsinghua University, Xi'an Jiaotong University, and Huazhong University.

Key Findings

▶ Watch: Embedding attribution via gradient analysis and interpolation (4:00)

Near-perfect payload localization: Across multiple datasets, the framework achieves F1 scores approaching 1.0 for identifying which HTTP fields contain malicious payloads. This performance is consistent even with very limited location-labeled training data.

Stable performance with minimal labeled data: Unlike baseline localization methods whose performance varies significantly with the number of location-labeled training samples, the proposed method maintains consistent performance across all data sizes and datasets.

Robustness against data poisoning: Under both detection model poisoning and localization model poisoning, the framework's performance degrades only slightly. The localization model is particularly robust, maintaining stable performance even at higher poisoning ratios.

26% recall improvement for WAF rules: Localized payloads can be automatically clustered and converted into Suricata-compatible WAF rules. On the FPA dataset, generated rules improved WAF recall by 26%, demonstrating practical value in strengthening existing defense infrastructure.

Outperforms specialized baselines: The method significantly outperforms state-of-the-art methods specifically designed for localization tasks across all evaluation datasets.

Technical Deep Dive

▶ Watch: Malicious payload localization with lightweight classifier (5:00)

The framework operates in three stages on requests that have already been classified as attacks by an existing DL-based detection model:

Module 1: Embedding Attribution. This module analyzes the trained detection model's behavior by assessing the influence of each embedding value on its predictions. For a detected attack request, it computes gradients of the output labels with respect to each embedding value in the model. To mitigate noise and provide a global view of importance, it performs linear interpolation between the embeddings of the original HTTP request and an empty request (an Integrated Gradients approach). This produces a continuous importance score for each embedding dimension.

Module 2: HTTP Structure Alignment. This module maps embedding importance scores to the structured fields of the HTTP request through two-stage aggregation:

1. Token-level aggregation: Consolidates embedding values of each token into token importance scores using dot product operations tailored to the embedding structure.
2. Protocol-level aggregation: Identifies which tokens correspond to which HTTP fields (method, URI, specific headers, body parameters) and aggregates token importance scores using summation operations to produce per-field importance scores.

This alignment respects the HTTP protocol structure, ensuring that importance scores are meaningful in the context of how web attacks actually work.

Module 3: Malicious Payload Localization. This module takes the per-field importance scores from Module 2 and classifies each field as containing or not containing a malicious payload. It constructs specialized location features for each HTTP field by integrating:

• Textual semantics: The actual content of the field
• Importance scores: The gradient-derived importance from the previous modules

A lightweight binary classifier is trained on a very limited number of location-labeled attack requests (where a human has annotated which specific fields contain the malicious payload). The classifier predicts payload presence for each field independently.

Practical WAF Rule Generation: Localized payloads are clustered using edit distance to group semantically similar payloads. For each cluster, Suricata-compatible rules are generated by determining the match scope (which HTTP field to inspect) and extracting regular expressions that capture common patterns across the cluster.

Demo / Proof of Concept

▶ Watch: Robustness against detection and localization model poisoning (7:00)

No live demo was performed. The evaluation used four datasets: two widely-used public datasets (CSIC and PKDDD), a newly constructed dataset called FPAD, and its out-of-distribution variant FPAOD. Each dataset contains original HTTP requests, attack category labels, and location labels for malicious payloads. Performance trend analysis showed the method maintaining significant advantages over baselines as the number of location-labeled training samples varied. The WAF rule generation experiment demonstrated practical impact: adding generated rules improved recall from 0.274 to 0.934 on the FPA dataset, with only a small increase in false positives due to occasional localization errors.

Defensive Implications

▶ Watch: WAF rule generation: 26% recall improvement on FPA dataset (8:00)

Bridging the DL-to-SOC gap: The framework addresses a real operational problem: security operators need to understand why a request was flagged, not just that it was flagged. By pinpointing the exact field containing the malicious payload, the framework reduces manual analysis time and increases operator trust in DL-based detection systems.

Automated WAF rule generation: The ability to automatically generate WAF rules from localized payloads creates a feedback loop between DL-based detection and traditional WAF infrastructure. Organizations can use DL models for offline detection of WAF-missed attacks, then automatically generate rules to close those gaps in real-time defense.

Minimal labeling requirement: The localization model requires very few location-labeled training examples, making it practical to deploy even when detailed attack annotations are scarce. Organizations can start with a small set of analyst-annotated examples and achieve near-perfect localization.

Poisoning robustness: The framework's demonstrated robustness against data poisoning attacks is important for production deployment where adversaries may attempt to degrade detection capabilities through training data manipulation.

Key Takeaways

• The framework provides interpretable web attack detection by localizing malicious payloads within specific HTTP request fields, achieving F1 scores near 1.0
• Three-module pipeline: embedding attribution (gradient analysis), HTTP structure alignment (protocol-aware aggregation), and payload localization (lightweight classifier)
• Performance is stable even with very limited location-labeled training data, outperforming specialized baseline methods
• Localized payloads can be automatically clustered and converted to Suricata WAF rules, improving recall by up to 26%
• The framework is robust against both detection model and localization model poisoning attacks
• Practical deployment bridges the gap between opaque DL-based detection and actionable operator insights

About the Speaker(s)

The work was presented by Jen on behalf of the authors from Tsinghua University, Xi'an Jiaotong University, and Huazhong University, who could not attend due to visa issues. Peiyang Li is listed as the primary speaker. The research team works at the intersection of deep learning interpretability and web security, aiming to make ML-based security tools more operationally useful for security teams.