Programming-Language-Aware Models for Effective Web Attack Detection

Web applications remain prime targets for SQL injection, cross-site scripting (XSS), command injection and other sophisticated exploits that are often hidden inside HTTP requests. Conventional signature-based Web Application Firewalls (WAFs) struggle with zero-day variants and obfuscated payloads. We present WABert, a Transformer-based detector that is programming-language-aware: it is first pre-trained on nearly one hundred million source-code files spanning thirty-two languages, and is then fine-tuned on twenty categories of real-world web-attack payloads. Experiments on five public datasets—CSIC-2010, FWAF-2017, HttpParams-2020, CICIDS-2018 and WADE-2022—plus one proprietary carrier-grade dataset demonstrate that WABert achieves up to 98% accuracy and outperforms baselines including standard BERT, CodeBERT, CNNs, SVMs and Random Forests. Ablation reveals that language-aware pre-training contributes $2 \sim 5 \mathrm{pp}$ accuracy over purely text-based models, while hierarchical token masking offers a further 1.7 pp. The model has been deployed in a live electric-utility SOC, maintaining a ${\lt}0.3 \%$ false-positive rate over three months of traffic.