Web Attack Detection on CSIC 2010
100RecallHRAL
Evaluation results
| Method | Links | ||||
|---|---|---|---|---|---|
| HRALAttack Type=Attack2026.04 | 100 | — | 100 | 100 | |
| HRALAttack Type=File_Inclusion2026.04 | 100 | — | 100 | 100 | |
| HRALAttack Type=Macro Avg2026.04 | 100 | — | 100 | 100 | |
| WADBERT2026.01 | 99.39 | 99.7 | 99.87 | 99.63 | |
| EDL2026.01 | 98.42 | 99.13 | 99.45 | 98.93 | |
| BERT-BiLSTM2026.01 | 98.23 | 98.38 | 97.84 | 98.04 | |
| DistilBERT2026.01 | 98.16 | 99.18 | 99.82 | 98.99 | |
| TransURL2026.01 | 98.05 | 99.15 | 99.88 | 98.95 | |
| CEF-Log (k=4)Model=Gemini Flash 2.5, Prompting Strategy=CEF-Log, k=42026.06 | 98 | 98 | 99 | 98 | |
| PMANET2026.01 | 96.38 | 98.17 | 99.14 | 97.74 | |
| Few-Shot (Standard)Data Requirement=High (40 examples), Primary Forensic Limitation=Requires excessive pre-labeled data, which is rarely available in active investigations2026.06 | 96 | — | — | 98 | |
| Few-Shot (k=40)Model=Gemini Flash 2.5, Prompting Strategy=Few-Shot, k=402026.06 | 96 | 98 | 99 | 98 | |
| CNN-BiLSTM2026.01 | 95.81 | 96.72 | 96.19 | 96 | |
| CEF-LogData Requirement=Low (4 examples), Primary Forensic Limitation=-2026.06 | 95 | — | — | 99 | |
| Few-Shot (k=20)Model=Gemini Flash 2.5, Prompting Strategy=Few-Shot, k=202026.06 | 78 | 89 | 99 | 87 | |
| Few-Shot (k=10)Model=Gemini Flash 2.5, Prompting Strategy=Few-Shot, k=102026.06 | 76 | 88 | 99 | 86 | |
| MRGAttack Type=Attack2026.04 | 70.93 | — | 100 | 83 | |
| MRGAttack Type=Macro Avg2026.04 | 69.78 | — | 100 | 82.2 | |
| MRGAttack Type=File_Inclusion2026.04 | 68.63 | — | 100 | 81.39 | |
| Zero-ShotData Requirement=None, Primary Forensic Limitation=High rate of false negatives; lacks contextual depth for complex attacks2026.06 | 59 | — | — | 73 | |
| Zero-ShotModel=Gemini Flash 2.5, Prompting Strategy=Zero-Shot2026.06 | 59 | 79 | 99 | 73 | |
| Role-Based (Cybercrime)Model=Gemini Flash 2.5, Prompting Strategy=Role-Based, Role=Cybercrime2026.06 | 53 | 76 | 100 | 68 | |
| Role-BasedData Requirement=None, Primary Forensic Limitation=Marginal improvement over zero-shot; fails to provide significant performance gains2026.06 | 52 | — | — | 68 | |
| Role-Based (Forensic)Model=Gemini Flash 2.5, Prompting Strategy=Role-Based, Role=Forensic2026.06 | 52 | 76 | 99 | 68 | |
| Role-Based (Security)Model=Gemini Flash 2.5, Prompting Strategy=Role-Based, Role=Security2026.06 | 50 | 75 | 99 | 66 |