Deep detection method for web attacks based on spatial attention and CNN-GRU

Abstract

Web application security faces significant threats from SQL injection (SQLi) and Cross-Site Scripting (XSS) attacks, which are characterized by high variability and concealment. Traditional detection methods relying on rule matching or shallow machine learning features struggle to identify novel and obfuscated attacks. To address these limitations, this paper proposes a deep detection model based on Spatial Attention mechanism, Convolutional Neural Networks (CNN), and Gated Recurrent Units (GRU). First, we introduce a character-level vectorization method using ASCII codes to convert raw payloads into two-dimensional numerical matrices, preserving fine-grained structural features without the semantic loss associated with word segmentation. Second, a hybrid CNN-GRU architecture is designed to simultaneously extract local spatial features and long-term temporal dependencies. Furthermore, a spatial attention mechanism is integrated to dynamically weight key feature regions, enhancing the model’s focus on malicious patterns while suppressing noise. To validate the architectural choice, we systematically compare the 2D reshaping strategy against a 1D sequential CNN baseline, demonstrating that multi-dimensional spatial extraction combined with attention effectively mitigates potential cross-row boundary effects. Experimental results on public datasets demonstrate that the proposed Attention-CNN-GRU model achieves an accuracy of 99.5% for SQLi and 98.8% for XSS, outperforming traditional machine learning methods and other deep learning baselines. Additionally, the model exhibits robust performance in small-sample scenarios, maintaining an accuracy of over 95%, which validates its effectiveness in data-scarce real-world environments.