The selection of pre-processing methods for requests in web application firewalls (WAFs) that use machine learning is critical in determining performance, latency, and computational resource consumption for detecting web attacks. Among pre-processing techniques, the combination of N -gram and term frequency-inverse document frequency (TF-IDF) is one of the most popular alternatives for pre-processing. However, this approach often results in high dimensionality, which can negatively impact latency and resource usage. The key challenge lies in achieving a balance between effective attack detection and resource efficiency. This article proposes a framework for evaluating WAF architectures that preserves detection performance while reducing the number of variables by at least 80%.
Cilento et al. (Mon,) studied this question.