Literature Review: A Machine Learning Approach to Web Attack Detection
DOI:
https://doi.org/10.51903/3w0vwc80Keywords:
Web attack detection, Machine Learning, Deep Learning, Intrusion Detection System (IDS), TransformerAbstract
The rapid growth of web technologies and online services has increased the exposure of web applications to cyber threats such as Cross-Site Scripting (XSS) and SQL Injection (SQLi). Conventional rule-based mechanisms, such as Web Application Firewalls (WAFs), often fail to detect emerging attack patterns. To address this, Machine Learning (ML) and Deep Learning (DL) have emerged as adaptive approaches for enhancing web attack detection. This study performs a Systematic Literature Review (SLR) following the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020 guidelines to analyze recent ML/DL-based detection methods. Of the 263 retrieved studies, 15 met the inclusion criteria for detailed review. The findings reveal that Random Forest (RF), Support Vector Machine (SVM), Convolutional Neural Network (CNN), and Long Short-Term Memory (LSTM) are the most applied algorithms. At the same time, recent works emphasize Transformer-based and hybrid ML–DL models. These approaches achieved robust performance (accuracy 85–97%, F1-score >90%) but still face challenges in dataset representativeness, class imbalance, and computational cost. This review highlights future research directions in Explainable Artificial Intelligence (XAI), Federated Learning (FL), and adversarial robustness to develop more efficient and trustworthy web attack detection systems.
References
[1] R. Z. Muttaqin and D. Sudiana, “Design of Realtime Web Application Firewall on Deep Learning-Based to Improve Web Application Security,” J. Penelit. Pendidik. IPA, vol. 10, no. 12, pp. 11121–11129, 2025, doi: 10.29303/jppipa.v10i12.8346.
[2] W. H. Aljuaid and S. S. Alshamrani, “A Deep Learning Approach for Intrusion Detection Systems in Cloud Computing Environments,” Appl. Sci., vol. 14, no. 13, p. 5381, 2024, doi: 10.3390/app14135381.
[3] N. W. Khan et al., “A Hybrid Deep Learning-Based Intrusion Detection System for IoT Networks,” Math. Biosci. Eng., vol. 20, no. 8, pp. 13491–13520, 2023, doi: 10.3934/mbe.2023602.
[4] R. Chaganti, W. Suliman, V. Ravi, and A. Dua, “Deep Learning Approach for SDN-Enabled Intrusion Detection System in IoT Networks,” Inf., vol. 14, no. 1, pp. 1–21, 2023, doi: 10.3390/info14010041.
[5] R. A. Elsayed, R. A. Hamada, M. I. Abdalla, and S. A. Elsaid, “Securing IoT and SDN Systems Using Deep-Learning Based Automatic Intrusion Detection,” Ain Shams Eng. J., vol. 14, no. 10, p. 102211, 2023, doi: 10.1016/j.asej.2023.102211.
[6] N. Nikhlis, M. Jamal, and U. Ghofur, “Deteksi Dini Pencurian Data pada Perangkat Seluler Menggunakan Machine Learning,” J. Ilm. Sist. Inf., vol. 4, no. 2, pp. 110–129, May 2025, doi: 10.51903/fz0xzt26.
[7] A. M. Asmaraloka, K. Nisa, M. A. Hermansyah, F. H. D. Saputra, and A. Setiawan, “Implementation of the K-Nearest Neighbor (KNN) Algorithm in Handwritten Digit Pattern Recognition Using the Zoning Method,” J. Ilm. Sist. Inf., vol. 4, no. 2, pp. 175–185, May 2025, doi: 10.51903/kf6s5f56.
[8] F. Syaila, P. Azzahra, and C. Printo, “Tinjauan Literatur Sistematis: Analisis Implementasi Kecerdasan Buatan untuk Verifikasi Dokumen,” J. Ilm. Sist. Inf., vol. 4, no. 3, pp. 417–430, Aug. 2025, doi: 10.51903/kjjwk708.
[9] R. W. Shiddiq, N. Karna, and I. D. Irawati, “Optimizing Machine Learning-Based Network Intrusion Detection System with Oversampling, Feature Selection and Extraction,” J. Ilm. Tek. Elektro Komput. dan Inform., vol. 11, no. 2, pp. 225–237, 2025, doi: 10.26555/jiteki.v11i2.30675.
[10] N. Mohamed, “Current Trends in AI and ML for Cybersecurity: A State-of-the-Art Survey,” Cogent Eng., vol. 10, no. 2, p. 2272358, 2023, doi: 10.1080/23311916.2023.2272358.
[11] A. Salam, F. Ullah, F. Amin, and A. Mohammad, “Deep Learning Techniques for Web-Based Attack Detection in,” Mdpi, vol. 11, no. 4, pp. 1–18, 2023, doi: 10.3390/technologies11040107.
[12] R. L. Alaoui and E. H. Nfaoui, “Deep Learning for Vulnerability and Attack Detection on Web Applications: A Systematic Literature Review,” Futur. Internet, vol. 14, no. 4, p. 118, 2022, doi: 10.3390/fi14040118.
[13] T. Subramani, V. Jeganathan, and S. Kunkuma Balasubramanian, “Machine learning and deep learning techniques for poultry tasks management: a review,” Multimed. Tools Appl., vol. 84, no. 2, pp. 603–645, 2025, doi: 10.1007/s11042-024-18951-0.
[14] S. Sagar and C. Keke, “Confidential Machine Learning on Untrusted Platforms: A Survey,” Cybersecurity, vol. 4, no. 1, p. 30, 2021, doi: 10.1186/s42400-021-00092-8.
[15] O. Arreche, T. Guntur, and M. Abdallah, “XAI-IDS: Toward Proposing an Explainable Artificial Intelligence Framework for Enhancing Network Intrusion Detection Systems,” Appl. Sci., vol. 14, no. 10, p. 4170, 2024, doi: 10.3390/app14104170.
[16] A. Alabbadi and F. Bajaber, “An Intrusion Detection System over the IoT Data Streams Using eXplainable Artificial Intelligence (XAI),” Sensors, vol. 25, no. 3, p. 847, 2025, doi: 10.3390/s25030847.
[17] E. M. Timofte et al., “Federated Learning for Cybersecurity: A Privacy-Preserving Approach,” Appl. Sci., vol. 15, no. 12, pp. 1–27, 2025, doi: 10.3390/app15126878.
[18] M. Rahmati and A. Pagano, “Federated Learning-Driven Cybersecurity Framework for IoT Networks with Privacy Preserving and Real-Time Threat Detection Capabilities,” Informatics, vol. 12, no. 3, p. 62, 2025, doi: 10.3390/informatics12030062.
[19] L. Segurola-Gil, M. Moreno-Moreno, I. Irigoien, and A. M. Florez-Tapia, “Unsupervised Anomaly Detection Approach for Cyberattack Identification,” Int. J. Mach. Learn. Cybern., vol. 15, no. 11, pp. 5291–5302, 2024, doi: 10.1007/s13042-024-02237-w.
[20] H. Park, D. Shin, C. Park, J. Jang, and D. Shin, “Unsupervised Machine Learning Methods for Anomaly Detection in Network Packets,” Electronics, vol. 14, no. 14, p. 2779, 2025, doi: 10.3390/electronics14142779.
[21] R. T. Lo, W. J. Hwang, and T. M. Tai, “SQL Injection Detection Based on Lightweight Multi-Head Self-Attention,” Appl. Sci., vol. 15, no. 2, pp. 1–17, 2025, doi: 10.3390/app15020571.
[22] F. Younas, A. Raza, N. Thalji, L. Abualigah, R. A. Zitar, and H. Jia, “An Efficient Artificial Intelligence Approach for Early Detection of Cross-Site Scripting Attacks,” Decis. Anal. J., vol. 11, p. 100466, 2024, doi: 10.1016/j.dajour.2024.100466.
[23] R. Alhamyani and M. Alshammari, “Machine Learning-Driven Detection of Cross-Site Scripting Attacks,” Information, vol. 15, no. 7, p. 420, 2024, doi: 10.3390/info15070420.
[24] M. AlJamal et al., “A Robust Machine Learning Model for Detecting XSS Attacks on IoT over 5G Networks,” Futur. Internet, vol. 16, no. 12, pp. 1–18, 2024, doi: 10.3390/fi16120482.
[25] R. Alqura’n et al., “Advancing XSS Detection in IoT over 5G: A Cutting-Edge Artificial Neural Network Approach,” Internet of Things, vol. 5, no. 3, pp. 478–508, 2024, doi: 10.3390/iot5030022.
[26] I. S. Crespo-Martínez, A. Campazas-Vega, Á. M. Guerrero-Higueras, V. Riego-DelCastillo, C. Álvarez-Aparicio, and C. Fernández-Llamas, “SQL Injection Attack Detection in Network Flow Data,” Comput. Secur., vol. 127, p. 103093, 2023, doi: 10.1016/j.cose.2023.103093.
[27] S. K. Erskine, “Real-Time Large-Scale Intrusion Detection and Prevention System (IDPS) CICIoT Dataset Traffic Assessment Based on Deep Learning,” Appl. Syst. Innov., vol. 8, no. 2, p. 52, 2025, doi: 10.3390/asi8020052.
[28] X. Li et al., “An LSTM Based Cross-Site Scripting Attack Detection Scheme for Cloud Computing Environments,” J. Cloud Comput., vol. 12, no. 1, p. 118, 2023, doi: 10.1186/s13677-023-00483-x.
[29] A. H. Salem, S. M. Azzam, O. E. Emam, and A. A. Abohany, Advancing Cybersecurity: A Comprehensive Review of AI-Driven Detection Techniques, vol. 11, no. 1. Springer International Publishing, 2024. doi: 10.1186/s40537-024-00957-y.
[30] R. Vadisetty et al., “Intelligent Detection of Injection Attacks via SQL Based on Supervised Machine Learning Models for Enhancing Web Security,” J. Artif. Intell. Big Data, vol. 4, no. 2, pp. 109–119, 2024, doi: 10.31586/jaibd.2024.1333.
[31] D. P. Purbawa, A. J. Ulhaq, G. Ikhsan, and A. M. Shiddiqi, “An Enhanced SQL Injection Detection Using Ensemble Method,” JUTI J. Ilm. Teknol. Inf., vol. 21, no. 1, pp. 1–9, 2023, doi: 10.12962/j24068535.v21i1.a1060.
[32] M. K. Baklizi et al., “Web Attack Intrusion Detection System Using Machine Learning Techniques,” Int. J. online Biomed. Eng., vol. 20, no. 3, pp. 24–38, 2024, doi: 10.3991/ijoe.v20i03.45249.
[33] S. H. Rafique, A. Abdallah, N. S. Musa, and T. Murugan, “Machine Learning and Deep Learning Techniques for Internet of Things Network Anomaly Detection—Current Research Trends,” Sensors (Basel), vol. 24, no. 6, p. 1968, 2024, doi: 10.3390/s24061968.
[34] N. P. Bora, P. M. Bora, V. S. Tidake, G. P. Dhomse, and D. P. Pawar, “AI-Driven Biometric Captcha: Defending Against Automated Threats in Web Security,” Int. J. Basic Appl. Sci., vol. 14, no. 1, pp. 32–39, 2025, doi: 10.14419/fab5t109.
[35] W. Kanakri and B. King, “PK-Judge: Enhancing IP Protection of Neural Network Models Using an Asymmetric Approach,” Big Data Cogn. Comput., vol. 9, no. 3, p. 66, 2025, doi: 10.3390/bdcc9030066.
[36] B. Buyuktanir, Ş. Altinkaya, G. Karatas Baydogmus, and K. Yildiz, “Federated Learning in Intrusion Detection: Advancements, Applications, and Future Directions,” Cluster Comput., vol. 28, no. 7, p. 66, 2025, doi: 10.1007/s10586-025-05325-w.
Downloads
Published
Issue
Section
License
Copyright (c) 2025 Nazli Rahmeisi, Eksa Umar Gani, Arief Arfriandi
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
All articles published in this journal are open access and licensed under the terms of the Creative Commons Attribution-ShareAlike 4.0 International License (CC BY-SA 4.0).
Under this license:
-
Authors retain copyright of their work.
-
Others are free to:
-
Share — copy and redistribute the material in any medium or format;
-
Adapt — remix, transform, and build upon the material for any purpose, even commercially;
-
-
As long as they:
-
Give appropriate credit to the original author(s) and the source;
-
Provide a link to the license;
-
Indicate if changes were made;
-
Distribute their contributions under the same license as the original.
-
This ensures that derivative works will also remain free and open under the same terms.
.png)
