Abstract: Web application attacks have always been a hot issue in cyberspace. With the continuous development of Web attack techniques, traditional intrusion detection systems and Web application firewalls are increasingly unable to meet the security protection needs. A Convolutional Gated Recurrent Unit (CGRU) neural network for detecting malicious Web requests based on feature fusion is proposed in this paper. The local features and high-order features of network events were captured by the designed network using CNN, traditional pooling methods are abandoned, and GRU is employed to collect features in the time dimension, replacing the original pooling layer. In addition, to improve detection performance, nine traditional machine learning statistical features are selected to complement the original features that perform effectively in web attack detection. Furthermore, the Word2Vec model is utilized to pretrain the word embedding matrix and obtain the input of CGRU model, which enables final results to be classified and facilitated the improvement of multi-classification accuracy. The proposed method is compared with current typical methods on the public HTTP CSIC 2010 dataset, and the results show that the accuracy, recall, F1-score, and precision of the proposed method are 99.81%, 99.78%, 98.80%, and 99.81%, respectively, which are all improved compared with the existing methods.

Key words: network attack, Web attack detection, neural network, gated recurrent unit, feature fusion