Model Web Application Firewall Berbasis Machine Learning untuk Mencegah Serangan Siber

Web applications serve as the main operational foundation of various strategic sectors, yet their vulnerability to cyberattacks poses a severe threat to data security. Conventional defense mechanisms often struggle to mitigate increasingly complex new attack variations. Previous research has extensively utilized Natural Language Processing (NLP) approaches, which entail high computational complexity, making them less optimal for real-time implementation. The objective of this research is to identify the most significant features using the Feature Importance with Random Forest algorithm and to compare the performance of Tree-Based Classifiers (Decision Tree, Random Forest, GBM, and XGBoost) in classifying HTTP traffic using CSIC 2010 dataset. Evaluation using Stratified K-Fold Cross Validation and Hyperparameter Tuning demonstrated that the Random Forest model was the most superior overall, achieving an F1-score of 92.71% and a Recall of 94.95% at K-Fold = 7, despite requiring a computation time of 289.76 seconds. Conversely, XGBoost offered the best compromise with an F1-score of 92% and an execution time of only 39.45 seconds. Meanwhile, the Decision Tree model emerged as the most efficient alternative for systems prioritizing speed, with a computation time of just 2.05 seconds. Research that held proves that the non-NLP Tree-Based Classifier approach provides competitive detection performance, is lightweight, and possesses high interpretability, making it highly optimal for modern Web Application Firewall implementations.