TDNET: A Dual-Channel Injection Attack Detection Framework for Web Application Firewalls

Abstract

Web injection attacks continue to threaten critical infrastructures in power network environments because traditional Web Application Firewalls show limited adaptability when attack payloads become obfuscated or structurally modified. Existing detection approaches also face challenges from heterogeneous payload structures and the trade-off between detection accuracy and inference efficiency under high-concurrency environments. We thus propose an injection attack detection framework, TDNET, that combines dual-channel feature extraction, multidimensional feature fusion, adaptive attention refinement, and time-sensitive neural architecture search optimization. Unlike prior work that adopts off-the-shelf components, each module in TDNET is specifically adapted for the injection detection task: the character channel captures fine-grained structural perturbations, the subword channel preserves semantic token relationships, and a cross-layer fusion mechanism retains hierarchical representations from all encoder depths. Experiments on public datasets and generated attack samples containing SQL injection, XSS, and RCE payloads demonstrate that TDNET achieves an F1-score of 98.13%, which exceeds the compared baselines by an average of 3.94%. Ablation studies confirm that the dual-channel design provides complementary gains over single-channel variants, and the FPD-searched architecture reduces normalized inference time to 65.47% while maintaining detection performance close to the full architecture.