Dual Character–Symbol Encoding with CNN–BiGRU–Multi-Head Attention for SQL Injection and Cross-Site Scripting Detection

Abstract

SQL injection (SQLi) and cross-site scripting (XSS) remain persistent threats to web applications because malicious intent is often expressed through short, obfuscated, and syntax-sensitive input strings. Conventional signature-based filters and rule-driven web application firewalls provide useful protection, but their dependence on predefined patterns limits their ability to generalize to novel payload variants. This paper presents a dual character–symbol encoding framework for classifying web inputs as SQLi, XSS, or normal traffic. The approach combines a character-index representation that preserves lexical order with a symbol tag representation that emphasizes security-relevant punctuation, delimiters, operators, and script markers. These representations are processed by a hybrid neural architecture composed of convolutional layers, bidirectional gated recurrent units, and multi-head self-attention. The convolutional component captures local attack motifs, the recurrent component models bidirectional payload context, and the attention component highlights multiple salient regions within an input sequence. The study uses a Kaggle SQLi–XSS mixed payload dataset reported as containing approximately 152,872 labelled payloads. The complete pipeline includes payload cleaning, duplicate removal, comment normalization, fixed-length sequence encoding, neural classification, and deployment through a Flask-based REST interface. The experimental evaluation reports an improvement in overall accuracy from 99.3% in a 20-epoch configuration to 99.7% in a 10-epoch configuration, indicating that shorter training reduced overfitting for this dataset. The work contributes a deployable low-level representation pipeline and a technically justified hybrid architecture for payload level web attack detection.