Enhanced Web Payload Classification Using WAMM: An AI-Based Framework for Dataset Refinement and Model Evaluation

Abstract

Web applications increasingly face evasive and polymorphic attack payloads, yet traditional Web Application Firewalls (WAFs) based on static rule sets such as the Open Web Application Security Project (OWASP) Core Rule Set (CRS) often miss obfuscated or zero-day patterns without extensive manual tuning. This work introduces the Web Attack Multi-classification Model (WAMM) as an Artificial Intelligence (AI)-driven multiclass web attack detection framework designed to reveal the limitations of rule-based systems by reclassifying Hypertext Transfer Protocol (HTTP) requests into OWASP-aligned categories for a specific technology stack. WAMM applies a multi-phase enhancement pipeline to the Security Research - Benign and Harmful (SR-BH) 2020 dataset that includes large-scale deduplication, large language Model (LLM)-guided relabeling, realistic attack data augmentation, and LLM-based filtering, producing three refined datasets. Four machine and deep learning models are evaluated using a unified feature space built from statistical and text-based representations. Results show that using an augmented and LLM-filtered dataset on the same technology stack, Extreme Gradient Boosting (XGBoost) reaches 99.59% accuracy with microsecond-level inference while deep learning models degrade under noisy augmentation. When tested against OWASP CRS using an unseen augmented dataset, WAMM achieves true positive block rates between 96 and 100% with improvements of up to 86%. These findings expose gaps in widely deployed rule-based defenses and demonstrate that curated training pipelines combined with efficient machine learning models enable a more resilient, real-time approach to web attack detection suitable for production WAF environments.