Multi-label common attack pattern enumeration and classification for enhanced web attack detection using optimized temporal inductive path neural networks

Web applications are an important component in modern digital services, with users and companies increasingly moving applications and sensitive information to cloud-based environments. This widespread adoption, however, has significantly increased the vulnerability of web applications to cyber-attacks. As such, the detection of web attacks with sufficient accuracy and efficiency is a major challenge in the field of cybersecurity. In this manuscript, TIPNN–ML–CAPEC is proposed, which is a multi-label web attack detection framework combining Event-triggered Consensus Kalman Filtering (ECKF), Artificial Protozoa Optimizer (APO), Temporal Inductive Path Neural Networks (TIPNN), and Parrot Optimizer Algorithm (POA). The approach is evaluated on the SR-BH 2020 dataset, which contains 13 CAPEC attack classes. The collected records are first passed through a deterministic exact-duplicate removal step; Event-triggered Consensus Kalman Filtering (ECKF) is then applied to the resulting feature streams to suppress measurement noise and to reconcile inconsistent observations. ECKF is a recursive state-estimation filter, and no claim is made that the filter itself performs record-level deduplication. The preprocessed data are then provided to the Artificial Protozoa Optimizer (APO), which is used for feature selection. The selected features are provided to the label annotation process, ensuring that each dataset instance is accurately mapped to one or more CAPEC attack patterns. Afterwards, Temporal Inductive Path Neural Networks (TIPNN) perform multi-label classification of Common Attack Pattern Enumeration and Classification (CAPEC) categories, namely Protocol Manipulation (PM), Code Injection (CI), OS Command Injection (OS-CI), Path Traversal (PT), SQL Injection (SQLI), Dictionary-based Password Attack (DPA), Vulnerability Scanning (VS), Input Data Manipulation (IDM), HTTP Verb Tampering (HTTP-VT), Source Spoofing (SS), HTTP Response Splitting (HTTP-RpS), HTTP Request Smuggling (HTTP-RqS) and normal. In general, TIPNN does not adopt any optimization approach to determine optimal parameters. The Parrot Optimizer Algorithm (POA) is therefore used to optimize TIPNN. The proposed TIPNN–ML-CAPEC method is then implemented and performance metrics such as accuracy, precision, specificity, recall, F-measure, ROC/AUC and computational time are analyzed. There are significant gains in recall and F1-score for TIPNN-ML-CAPEC compared to the reimplemented baseline models, as illustrated in Tables 5 and 6. Although these margins are point-estimate averages from fivefold cross-validation, they shouldn’t be regarded as statistically significant.