Semi-supervised method for anomaly detection in HTTP traffic

Anomaly detection in HTTP traffic is critical for securing web applications against evolving cyber threats. We propose a semi-supervised method that combines domain-specific language modeling with sequence reconstruction to identify anomalies in HTTP requests. Our approach leverages only benign traffic for training and uses reconstruction errors for detecting malicious activity. It achieves a strong balance between precision and recall while maintaining low computational requirements, making it suitable for real-time and edge deployments. Extensive evaluations on three public HTTP datasets show that our method outperforms traditional baselines and fine-tuned BERT models, with an F1-score of 0.92 and AUC of 0.96. We also introduce a simple interpretability mechanism by attributing anomalies to token-level reconstruction errors, providing insights into detected threats. The proposed solution is scalable, lightweight, and effective across diverse attack scenarios without requiring large labeled datasets.