Cross-Domain Semi-Supervised Detection of Zero-Day Web Application Attacks via Multi-Modal HTTP Request and Payload Features

Zero-day web application attacks pose a significant threat to modern web infrastructure, exploiting previously unknown vulnerabilities that evade traditional signature-based detection systems. This paper presents a novel cross-domain semi-supervised learning framework for detecting zero-day web attacks by leveraging multi-modal features extracted from HTTP request metadata and payload content. Our approach combines Long Short-Term Memory (LSTM) networks, Gated Recurrent Units (GRUs), and stacked autoencoders in an ensemble architecture trained on benign traffic data to identify anomalous attack patterns. We employ character-level tokenization strategies to capture fine-grained payload characteristics and integrate HTTP header features to enrich the detection model. The framework is evaluated in a cross-domain setting where models trained on one dataset are tested on unseen attack types from different domains. Experimental results on three benchmark datasets— CSIC 2010 HTTP Dataset, SQL Injection Dataset, and Web Application Payloads Dataset—demonstrate that our approach achieves 97.58% accuracy, 97.52% recall, and 99.99% precision with a false positive rate of only 0.2%, significantly outperforming traditional supervised and single-domain approaches. The proposed framework effectively generalizes across different attack types including SQL injection, cross-site scripting, and buffer overflow, establishing its viability for real-world deployment in web application firewalls and intrusion detection systems.