# HTTP2vec: Embedding of HTTP Requests for Detection of Anomalous Traffic

arXiv: https://arxiv.org/abs/2108.01763 · HTML: https://mlsanity.com/paper/2108.01763/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 20 references that are in the map.
- First posted on arXiv 3 Aug 2021.

## Builds on (most cited first, 5 of 5)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [RoBERTa: A Robustly Optimized BERT Pretraining Approach](https://mlsanity.com/paper/1907.11692/) (2019)
- [Neural Machine Translation of Rare Words with Subword Units](https://mlsanity.com/paper/1508.07909/) (2015)
- [Neural Machine Translation with Byte-Level Subwords](https://mlsanity.com/paper/1909.03341/) (2019)
- [Deep Anomaly Detection in Packet Payload](https://mlsanity.com/paper/1912.02549/) (2019)

## Built on by (most cited first, 6 of 6)

- [Machine Learning with DBOS](https://mlsanity.com/paper/2208.05101/) (2022)
- [A Novel Approach To User Agent String Parsing For Vulnerability Analysis Using Mutli-Headed Attention](https://mlsanity.com/paper/2306.03733/) (2023)
- [Fingerprinting web servers through Transformer-encoded HTTP response headers](https://mlsanity.com/paper/2404.00056/) (2024)
- [Enhancing web traffic attacks identification through ensemble methods and feature selection](https://mlsanity.com/paper/2412.16791/) (2024)
- [X-WAD: eXplainable Web Anomaly Detection](https://mlsanity.com/paper/2608.27172/) (2026)
- [Comparative Evaluation of Static Embedding Models for HTTP Request Anomaly Detection](https://mlsanity.com/paper/2609.26860/) (2026)

## Abstract (arXiv)

Hypertext transfer protocol (HTTP) is one of the most widely used protocols on the Internet. As a consequence, most attacks (i.e., SQL injection, XSS) use HTTP as the transport mechanism. Therefore, it is crucial to develop an intelligent solution that would allow to effectively detect and filter out anomalies in HTTP traffic. Currently, most of the anomaly detection systems are either rule-based or trained using manually selected features. We propose utilizing modern unsupervised language representation model for embedding HTTP requests and then using it to classify anomalies in the traffic. The solution is motivated by methods used in Natural Language Processing (NLP) such as Doc2Vec which could potentially capture the true understanding of HTTP messages, and therefore improve the efficiency of Intrusion Detection System. In our work, we not only aim at generating a suitable embedding space, but also at the interpretability of the proposed model. We decided to use the current state-of-the-art RoBERTa, which, as far as we know, has never been used in a similar problem. To verify how the solution would work in real word conditions, we train the model using only legitimate traffic. We also try to explain the results based on clusters that occur in the vectorized requests space and a simple logistic regression classifier. We compared our approach with the similar, previously proposed methods. We evaluate the feasibility of our method on three different datasets: CSIC2010, CSE-CIC-IDS2018 and one that we prepared ourselves. The results we show are comparable to others or better, and most importantly - interpretable.