EBTM: Web Vulnerability Attack Behavior Recognition Method Based on Feature Fusion

INTRODUCTION: With the continuous expansion of network scale, effectively detecting web vulnerability attacks has become a critical challenge for ensuring network security. Existing research, primarily focused on balanced sample recognition, proves inadequate for real-world scenarios due to high false alarm rates in large-scale traffic and poor recognition performance for minority attack samples caused by imbalanced data distribution. OBJECTIVES: This paper aims to address the limitations of current web vulnerability attack detection methods in imbalanced real-world environments. The objective is to propose a novel recognition method that reduces the false positive rate and improves the identification performance for minority attack samples under highly skewed data distributions. METHODS: We propose a feature fusion-based recognition method named EBTM for imbalanced samples. The method integrates expert knowledge to optimize feature selection, focusing on key information and ensuring a more uniform mapping of URL requests. It employs three output features from different advantageous models for feature fusion, thereby generating a richer and more discriminative feature representation for the final recognition task. RESULTS: Experimental results demonstrate that the proposed EBTM method significantly enhances the recognition of web vulnerability attack behaviors. Under a realistic imbalanced condition where attack samples constitute only about 3% of the data, the model achieves a macro-average F1 score of 99.1% and reduces the false positive rate to 0.054%. CONCLUSION: The EBTM method effectively improves the efficiency and accuracy of web vulnerability attack behavior recognition in practical, imbalanced scenarios. By combining expert-guided feature optimization and multi-model feature fusion, it successfully addresses key challenges of high false alarms and poor minority class recognition, offering a robust solution for securing large-scale network environments.