ByteShield: A Custom Layer-7 Web Application Firewall Using Shannon Entropy and Tokenization for Anomaly and Attack Detection

Author

Shubham Mishra, Rishabh Manale, Rahul Prajapati

Abstract

 While web applications now underpin commerce, education, and public services, they remain exposed to injection, scripting, and abuse attacks that conventional defenses struggle to withstand. Traditional Layer-7 web application firewalls (WAFs) depend upon preconfigured signatures and regular expressions, which encoded, obfuscated, and nested payloads can circumvent. Contemporary research counteracts these limitations through hand-configured rule engines, anomaly detection, machine learning, deep learning, entropy-based analysis, lexical tokenization, behavioural profiling, and risk scoring. This paper presents a methodology-focused review of 50 sources documenting the progression of web application defense from static signature matching toward multi-signal, explainable detection. We examine how request normalization, attack signatures, payload statistics, token structure, client behaviour, mitigation policies, and security telemetry have been implemented and evaluated across the reviewed literature. Rather than comparatively ranking detection algorithms in isolation, this review analyzes candidate methods according to their defensive functions and architectural responsibilities. Our synthesis indicates that rule matching, anomaly detection, entropy analysis, tokenization, and rate control constitute mature individual research domains, yet their integration into one transparent, risk-driven inspection pipeline remains limited. We formulate this gap as methodological fragmentation. To resolve it, we derive methodological requirements for the proposed ByteShield architecture, encompassing a reverse-proxy gateway, request normalization, signature rules, Shannon entropy, lexical tokenization, behavioural analysis, weighted risk scoring, graduated mitigation, and a monitoring dashboard, establishing an unambiguous, traceable path from literature analysis to system design.

Keywords

web application firewall, reverse proxy, SQL injection, cross-site scripting, Shannon entropy, tokenization, anomaly detection, behavioural analysis, risk scoring.

Full Text:

Download Paper PDF

References

The following 50 sources form the review reference set. Bibliographic fields could not be checked against publisher records; every entry requires a final author, venue, and page check before submission.

Shar and Tan, Defeating SQL Injection, IEEE Computer, vol. 46, 2013.
OWASP Foundation, Inc., OWASP Top Ten Web Application Security Risks, 2021 edition, 2021.
Hydara, Sultan, Zulzalil, and Admodisastro, Current State of Research on Cross-Site Scripting (XSS): A Systematic Literature Review, Information and Software Technology, 2015.
Sarmah, Bhattacharyya, and Kalita, A Survey of Detection Methods for XSS Attacks, Journal of Network and Computer Applications, 2018.
Halfond, Viegas, and Orso, A Classification of SQL-Injection Attacks and Countermeasures, Proc. ISSSE, 2006.
Ingham et al., Learning DFA Representations of HTTP for Protecting Web Applications, Computer Networks, 2007.
Kruegel and Vigna, Anomaly Detection of Web-Based Attacks, Proc. ACM CCS, 2003.
Improving Web Application Firewalls to Detect Advanced SQL Injection Attacks, Xplore:7064617. [verify]
Torrano-Giménez et al., An Anomaly-Based Approach for Intrusion Detection in Web Traffic, Journal of Information Assurance and Security, vol. 5, 2010.
Web Application Firewall Using Proxy and Security Information and Event Management (SIEM) for OWASP Cyber Attack Detection, IEEE Xplore document 10346051. [Authors, year, and venue unverified.]
Valeur et al., A Learning-Based Approach to the Detection of SQL Attacks, DIMVA, 2005.
Tekerek and Bay, Design and Implementation of an Artificial Intelligence-Based Web Application Firewall Model, Neural Netw. World, 2019.
Kruegel, Vigna, and Robertson, A Multi-Model Approach to the Detection of Web-Based Attacks, Computer Networks, 2005.

Ristic, ModSecurity Handbook, 1st ed., Feisty Duck, London, U.K., 2010.
Robertson et al., Using Generalization and Characterization Techniques in the Anomaly-Based Detection of Web Attacks, NDSS, 2006.
Adaptive Web Application Firewall for Multi-Threat Detection, IEEE Xplore 10823239. [verify]
Betarte et al., Web Application Attacks Detection Using Machine Learning Techniques, ICMLA, 2018.

Bakır, UniEmbed: Word2Vec, USE, and FastText Embeddings with Machine Learning for XSS and SQL Injection Detection, 2025. [Venue and metadata unverified.]
Kar, Panigrahi, and Sundararajan, SQLiGoT: Detecting SQL Injection Attacks Using Graph of Tokens and SVM, Computers & Security (Elsevier), 2016.
Medeiros, Neves, and Correia, Detecting and Removing Web Application Vulnerabilities with Static Analysis and Data Mining, IEEE Transactions on Reliability, vol. 65, 2016.

Yu et al., DeepHTTP: Semantics-Structure Model with Attention for Anomalous HTTP Traffic Detection and Pattern Mining, arXiv:1810.12751, 2018. [Project slides cite 2021; verify.]
Fang et al., DeepXSS: Cross Site Scripting Detection Based on Deep Learning, Proc. ICCAI, 2018.

Likarish, Jung, and Jo, Obfuscated Malicious JavaScript Detection Using Classification Techniques, Proc. MALWARE, 2009.
Nunan et al., Automatic Classification of Cross-Site Scripting in Web Pages Using Document-Based and URL-Based Features, Proc. ISCC, 2012.
Pan et al., Detecting Web Attacks with End-to-End Deep Learning, JISA 2019.
Liang, Zhao, and Ye, Anomaly-Based Web Attack Detection: A Deep Learning Approach, Proc. ICNCC, 2017. [verify]

Ito and Iyatomi, Web Application Firewall Using Character-Level Convolutional Neural Network, IEEE CSPA, Penang, Malaysia, 2018.

Wang and Stolfo, Anomalous Payload-Based Network Intrusion Detection, RAID, Sophia Antipolis, 2004.

Gu, McCallum, and Towsley, Detecting Anomalies in Network Traffic Using Maximum Entropy Estimation, Proc. 5th ACM SIGCOMM Internet Measurement Conference (IMC), Berkeley, CA, 2005.
Lakhina, Crovella, and Diot, Mining Anomalies Using Traffic Feature Distributions, Proc. ACM SIGCOMM Conference, Philadelphia, PA, USA, 2005.
Wressnegger et al., A Close Look on n-Grams in Intrusion Detection, Proc. ACM Workshop on Artificial Intelligence and Security, 2013.

Bereziński, Jasiul, and Szpyrka, An Entropy-Based Network Anomaly Detection Method, Entropy, vol. 17, no. 4, 2015.

Shannon, A Mathematical Theory of Communication, Bell System Technical Journal, 1948.

Rieck and Laskov, Detecting Unknown Network Attacks Using Language Models, DIMVA, 2006.
Nychis et al., An Empirical Evaluation of Entropy-Based Traffic Anomaly Detection, Proc. ACM Internet Measurement Conference, Vouliagmeni, Greece, 2008.
Feinstein et al., Statistical Approaches to DDoS Attack Detection and Response, DARPA Information Survivability Conference and Exposition (DISCEX), 2003.
Lee and Xiang, Information-Theoretic Measures for Anomaly Detection, IEEE Symposium on Security and Privacy, 2001.

Appelt et al., Automated Testing for SQL Injection Vulnerabilities: An Input Mutation Approach, ISSTA, 2014.

Chandola et al., Anomaly Detection: A Survey, ACM Comput. Surv., vol. 41, no. 3, 2009.

Sommer and Paxson, Outside the Closed World: On Using Machine Learning for Network Intrusion Detection, Proc. IEEE S&P, 2010.

Mirkovic and Reiher, A Taxonomy of DDoS Attack and DDoS Defense Mechanisms, ACM SIGCOMM Comput. Commun. Rev., 2004.
Fogla et al., Polymorphic Blending Attacks, Proc. 15th USENIX Security Symposium, Vancouver, BC, 2006.

Cova et al., Swaddler: An Approach for the Anomaly-Based Detection of State Violations in Web Applications, Proc. RAID, Gold Coast, Australia, 2007.

Bates, Barth, and Jackson, Regular Expressions Considered Harmful in Client-Side XSS Filters, WWW, 2010.

Kirda et al., Noxes: A Client-Side Solution for Mitigating Cross-Site Scripting Attacks, ACM Symposium on Applied Computing (SAC), 2006.

Corona, Giacinto, and Roli, Adversarial Attacks Against Intrusion Detection Systems: Taxonomy, Solutions and Open Issues, Information Sciences, 2013.
Demetrio et al., WAF-A-MoLE: Evading Web Application Firewalls Through Adversarial Machine Learning, SAC, 2020.

Berners-Lee, Fielding, and Masinter, Uniform Resource Identifier (URI): Generic Syntax, RFC 3986, IETF, 2005.

Fielding and Reschke, Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing, RFC 7230, Internet Engineering Task Force (IETF), 2014.
SQL Injection Detection and Prevention Techniques, IEEE ICDSNS, 2025. [Authors, venue name, pages, and DOI unverified; entry taken from project slides.]

 

Share your valuable work from Social Media Buttons