# Comparative Evaluation of Static Embedding Models for HTTP Request Anomaly Detection

arXiv: https://arxiv.org/abs/2609.26860 · HTML: https://mlsanity.com/paper/2609.26860/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 26 references that are in the map.
- First posted on arXiv 22 Sep 2026.

## Builds on (most cited first, 6 of 6)

- [Efficient Estimation of Word Representations in Vector Space](https://mlsanity.com/paper/1301.3781/) (2013)
- [Enriching Word Vectors with Subword Information](https://mlsanity.com/paper/1607.04606/) (2016)
- [Distributed Representations of Sentences and Documents](https://mlsanity.com/paper/1405.4053/) (2014)
- [HTTP2vec: Embedding of HTTP Requests for Detection of Anomalous Traffic](https://mlsanity.com/paper/2108.01763/) (2021)
- [Capturing the security expert knowledge in feature selection for web application attack detection](https://mlsanity.com/paper/2407.18445/) (2024)
- [A Classification-by-Retrieval Framework for Few-Shot Anomaly Detection to Detect API Injection Attacks](https://mlsanity.com/paper/2405.11247/) (2024)

## Abstract (arXiv)

Web applications are increasingly targeted by cyberattacks that exploit HTTP requests to evade security mechanisms. Traditional web application firewalls (WAFs) rely on rule-based approaches that often exhibit high false positive rates and limited adaptability. Recent studies have explored machine learning techniques and word embedding models to improve anomaly detection in HTTP traffic. This paper presents a benchmark for static embedding models, specifically Word2Vec, FastText, and Doc2Vec, within a unified, single-class classification framework. We propose HEDA (HTTP Embedding-Based Detection Architecture), a modular detection pipeline that combines static embedding representations with single-class anomaly detection models to detect anomalies at the request level. The approach operates in an unsupervised environment, where both the embedding models and detectors are trained exclusively on benign HTTP traffic. The proposed methodology is evaluated on three datasets with heterogeneous characteristics, including both synthetic and real traffic. The experimental results show that the choice of embedding representation significantly affects detection performance, and that FastText-based embeds produce the most consistent results across all datasets, achieving high detection rates while keeping false positive rates under control.