Transformer Based End to End Web Application Firewall Pipeline for Intelligent Threat Detection

Abstract

ABSTRACT - Modern web applications face an unprecedented surge in sophisticated cyber threats, including SQL injection, cross-site scripting (XSS), remote code execution, and credential stuffing attacks. Traditional rule-based Web Application Firewalls fail to detect zero-day exploits and context-dependent attack patterns due to their static, signature-driven nature. This paper proposes an intelligent, transformer-based end-to-end Web Application Firewall (WAF) pipeline that leverages the self-attention mechanism of transformer architectures to capture long-range dependencies within HTTP request sequences. The proposed system ingests raw HTTP traffic, performs tokenization and feature extraction, and feeds the encoded representation into a fine-tuned BERT variant for binary and multi-class threat classification. The pipeline integrates preprocessing, model inference, and response action modules into a unified deployment-ready architecture. Experimental evaluation on benchmark intrusion datasets including CSIC 2010 and HTTPD-DS  demonstrates that the proposed transformer WAF achieves 97.8% detection accuracy, 96.4% F1-score, and sub-10ms inference latency, outperforming conventional machine learning and CNN-based approaches. This work establishes transformer models as a practical and deployable foundation for next-generation WAF systems. Keywords — Web Application Firewall, Transformer, BERT, HTTP Traffic Analysis, Intrusion Detection, Deep Learning, Cybersecurity, NLP