A Multi-Class Web Intrusion Detection System Using Deep Learning

Hiba Allah  Ziyad; Amer Abdulmajeed  Abdulrahman

doi:10.30526/39.4.4467

Authors

Hiba Allah Ziyad Department of Computer Science, College of Science, University of Baghdad, Baghdad, Iraq https://orcid.org/0009-0001-1375-7155
Amer Abdulmajeed Abdulrahman Computer Science Department, College of Science, University of Baghdad, Baghdad, Iraq https://orcid.org/0009-0001-9336-5003

DOI:

https://doi.org/10.30526/39.4.4467

Keywords:

Web Intrusion Detection, Deep Learning, Random Forest Feature Selection Stacking Ensemble Learning, Multi- Class Classification

Abstract

Web applications are an integral part of digital infrastructure in the modern era and have become increasingly susceptible to advanced cyber threats, thus needing more intelligent and adaptable intrusion detection system. Traditional signature and rule-based (IDS) systems have inherent limitations in detecting various types of web attacks because they are static in nature. This paper presents a multi-class web intrusion detection framework based on deep learning methods by using the WEB-IDS23 dataset, a realistic representation of modern web traffic environments and presents the first holistic multi-class evaluation on this dataset by employing an integrated deep learning and stacking-based ensemble model. The model utilizes Random Forest-based feature selection and combines it with three deep learning models (One-Dimensional Convolutional Neural Network (1D-CNN), Deep Neural Network (DNN) and Gated Recurrent Unit (GRU-RNN)). we then used a stacking-based meta-learning approach to aggregate the predictions. Strong detection performance is demonstrated in experiments. The 1D-CNN yielded best standalone accuracy of 96.43% and F1-score of 96.32%, while stacking ensemble further boosting the classification accuracy to 96.55% and precision to 97.15%. Although the stacking meta-model achieved a marginally lower F1-score compared to its standalone 1D-CNN, it performed with higher overall accuracy. This phenomenon is due to the imbalanced class distribution of the WEB-IDS23 dataset, where optimizing majority-class classification raised overall accuracy but lowered recall and precision on some minority classes. By combining these methods with feature selection, deep learning and stacking-based ensemble learning, the final result achieves higher accuracy in detection task as well as robust detection capability and scalability. The proposed system is an efficient approach for the multi-class web intrusion detection system

Author Biographies

Hiba Allah Ziyad, Department of Computer Science, College of Science, University of Baghdad, Baghdad, Iraq

-
Amer Abdulmajeed Abdulrahman, Computer Science Department, College of Science, University of Baghdad, Baghdad, Iraq

-

References

1. Alghawazi M.; Alghazzawi D.; Alarifi S. Detection of SQL Injection Attack Using Machine Learning Techniques: A Systematic Literature Review. J Cybersecur Priv. 2022, 2(4), 764–777. https://doi.org/10.3390/jcp2040039.

2. Kumar D.; Pateriya R.K.; Gupta R.K. DDoS Detection Using Deep Learning. Procedia Comput Sci. 2023, 2420–2429. https://doi.org/10.1016/j.procs.2023.01.217.

3. Tadhani J.R.; Vekariya V.; Sorathiya V. Securing web applications against XSS and SQLi attacks using a novel deep learning approach. Sci Rep. 2024, 14(1). https://doi.org/10.1038/s41598-023-48845-4.

4. Salam A.; Ullah F.; Amin F.Deep Learning Techniques for Web-Based Attack Detection in Industry 5.0: A Novel Approach. Technologies. 2023, 11(4). https://doi.org/10.3390/technologies11040107.

5. Kaream D. A. A.; Ali N. H. M. A Robust Base-layer Design for Hierarchical IoT Intrusion Detection Using Hybrid Deep Learning. Int J Intell Eng Syst. 2026, 19(5), 606–621. https://doi.org/10.22266/ijies2026.0531.35.

6. Dawadi B.R.; Adhikari B.; Srivastava D.K. Deep Learning Technique-Enabled Web Application Firewall for the Detection of Web Attacks. Sensors. 2023, 23(4). https://doi.org/10.3390/s23042073.

7. Dai Z.; Por L.Y.; Chen Y.L.. An intrusion detection model to detect zero-day attacks in unseen data using machine learning. PLoS ONE. 2024, 19(9). https://doi.org/10.1371/journal.pone.0308469.

8. Mohammadpour L.; Ling T.C.; Liew C.S. A Survey of CNN-Based Network Intrusion Detection. Appl Sci. 2022, 12(16). https://doi.org/10.3390/app12168162.

9. Alabsi B.A.; Anbar M.; Rihan S.D.A. CNN-CNN: Dual Convolutional Neural Network Approach for Feature Selection and Attack Detection on Internet of Things Networks. Sensors. 2023, 23(14). https://doi.org/10.3390/s23146507.

10. Kasongo S.M. A deep learning technique for intrusion detection system using a Recurrent Neural Networks based framework. Comput Commun. 2023, 199, 113–125. https://doi.org/10.1016/j.comcom.2022.12.010.

11. Mahdi S. S.; Abdulrahman A. A. Enhanced CAN Bus Intrusion Detection Using CNN-LSTM-Attention Networks with Time-based Feature Engineering. Int J Intell Eng Syst. 2026, 19(1). https://doi.org/10.22266/ijies2026.0131.34.

12. Qazi E.U.H.; Faheem M.H.; Zia T. HDLNIDS: Hybrid Deep-Learning-Based Network Intrusion Detection System. Appl. Sci. 2023, 13(8). https://doi.org/10.3390/app13084921.

13. Dhanya K.A.; Vajipayajula S.; Srinivasan K.. Detection of Network Attacks Using Machine Learning and Deep Learning Models. Procedia Comput Sci. 2023, 57–66. https://doi.org/10.1016/j.procs.2022.12.401.

14. Khan A.A.; Chaudhari O.; Chandra R. A Review of Ensemble Learning and Data Augmentation Models for Class Imbalanced Problems: Combination, Implementation and Evaluation. Expert Syst Appl. 2024, 244. https://doi.org/10.1016/j.eswa.2023.122778.

15. Alaoui R.L.; Nfaoui E.H. Deep Learning for Vulnerability and Attack Detection on Web Applications: A Systematic Literature Review. Fut Internet. 2022, 14(4). https://doi.org/10.3390/fi14040118.

16. Lanfer E.; Brockmann D.; Aschenbruck N. Technical Report: Generating the WEB-IDS23 Dataset. arXiv preprint arXiv:2502.03909, 2025. https://doi.org/10.48550/arXiv.2502.03909.

17. Lazzarini R.; Tianfield H.; Charissis V. A stacking ensemble of deep learning models for IoT intrusion detection. Knowledge-Based Syst. 2023, 279. https://doi.org/10.1016/j.knosys.2023.110941.

18. Silivery A.K.; Rao Kovvur R.M.; Solleti R. A model for multi-attack classification to improve intrusion detection performance using deep learning approaches. Meas Sens. 2023, 30. https://doi.org/10.1016/j.measen.2023.100924.

19. Zhang Y.; Muniyandi R.C.; Qamar F. A Review of Deep Learning Applications in Intrusion Detection Systems: Overcoming Challenges in Spatiotemporal Feature Extraction and Data Imbalance. Appl. Sci. 2025, 15(3). https://doi.org/10.3390/app15031552.

20. Umar M.A.; Chen Z.; Shuaib K.. Effects of feature selection and normalization on network intrusion detection. Data Sci Manag. 2025, 8(1), 23–39. https://doi.org/10.1016/j.dsm.2024.08.001.

21. Hashmi A.; Barukab O.M.; Osman A.H. A hybrid feature weighted attention based deep learning approach for an intrusion detection system using the random forest algorithm. PLoS ONE. 2024, 19(5). https://doi.org/10.1371/journal.pone.0302294.

22. Wang Y.; Liu Z.; Zheng W. A Combined Multi-Classification Network Intrusion Detection System Based on Feature Selection and Neural Network Improvement. Appl Sci. 2023, 13(14). https://doi.org/10.3390/app13148307.

23. Alghofaili L.N.; Ibrahim D.M. Web-Based Attacks Detection Using Deep Learning Techniques: A Comprehensive Review. Indones. J Electr Eng Comput Sci. 2025, 39(1), 466. https://doi.org/10.11591/ijeecs.v39.i1.pp466-484.

24. Kamil W. F.; Mohammed I. J. Adapted CNN-SMOTE-BGMM Deep Learning Framework for Network Intrusion Detection using Unbalanced Dataset. Iraqi J Sci. 2023, 64(9), 4846–4864. https://doi.org/10.24996/ijs.2023.64.9.43.

25. Hnamte V.; Hussain J. DCNNBiLSTM: An Efficient Hybrid Deep Learning-Based Intrusion Detection System. Telemat Inform .Rep. 2023, 10. https://doi.org/10.1016/j.teler.2023.100053.