The increasing sophistication of web-based services has intensified the risk of zero-day attacks, exposing critical vulnerabilities in user information security. Traditional detection systems often rely on labeled attack data and struggle to identify novel threats without prior knowledge. This paper introduces a novel one-class ensemble method for detecting zero-day web attacks, combining the strengths of Long Short-Term Memory (LSTM), Gated Recurrent Unit (GRU), and stacked autoencoders through latent representation concatenation and compression. Additionally, a structured tokenization strategy based on character-level analysis is employed to enhance input consistency and reduce feature dimensionality. The proposed method was evaluated using the CSIC 2012 dataset, achieving 97.58% accuracy, 97.52% recall, 99.76% specificity, and 99.99% precision, with a false positive rate of just 0.2%. Compared to conventional ensemble techniques like majority voting, our approach demonstrates superior anomaly detection performance by fusing diverse feature representations at the latent level rather than the output level. These results highlight the model’s effectiveness in accurately detecting unknown web attacks with low false positives, addressing major limitations of existing detection frameworks.

The increase of internet on websites has intensified the risks to user information security, with web attacks becoming more sophisticated and widespread. Except for known attacks, unknown (zero-day) attacks have become critical. Since traditional security methods often fail to mitigate new attack patterns, jeopardizing user data. Also, reducing human intervention in web security can minimize errors and enhance reliability. This paper presents an intelligent solution for detecting unknown web attacks using a one-class ensemble algorithm including LSTM autoencoder, GRU autoencoder, and stacked autoencoder. Our approach tokenizes normal web requests to create unique patterns, maps tokenized elements to numerical sequences, and use the ensemble model to identify anomalous behavior. This methodology enables efficient detection of zero-day attacks while addressing common challenges such as high memory usage, extensive time consumption, and high false positive rates. The proposed model was evaluated on key metrics, showing superior performance: 97.58% accuracy, 97.52% recall, 99.76% specificity, and 99.99% precision, with an exceptionally low false positive rate of 0.2%. The training phase took only 20 seconds, and the testing phase completed in 5 seconds, showcasing the model’s efficiency. These results highlight the potential of our approach to enhance web security by providing a fast, accurate, and reliable method for detecting web attacks.

The rapid growth in web-based services has significantly increased security risks related to user information, as web-based attacks become increasingly sophisticated and prevalent. Traditional security methods frequently struggle to detect previously unknown (zero-day) web attacks, putting sensitive user data at significant risk. Additionally, reducing human intervention in web security tasks can minimize errors and enhance reliability. This paper introduces an intelligent system designed to detect zero-day web attacks using a novel one-class ensemble method consisting of three distinct autoencoder architectures: LSTM autoencoder, GRU autoencoder, and stacked autoencoder. Our approach employs a novel tokenization strategy to convert normal web requests into structured numeric sequences, enabling the ensemble model to effectively identify anomalous activities by uniquely concatenating and compressing the latent representations from each autoencoder. The proposed method efficiently detects unknown web attacks while effectively addressing common limitations of previous methods, such as high memory consumption and excessive false positive rates. Extensive experimental evaluations demonstrate the superiority of our proposed ensemble, achieving remarkable detection metrics: 97.58% accuracy, 97.52% recall, 99.76% specificity, and 99.99% precision, with an exceptionally low false positive rate of 0.2%. These results underscore our method's significant potential in enhancing real-world web security through accurate and reliable detection of web-based attacks.