SecureAI-SE/http-attack-requests

license: cc-by-4.0 task_categories:

• —text-classification language:
• —en tags:
• —security
• —web-attacks
• —http
• —waf
• —payloads pretty_name: HTTP Attack Requests (multi-class) ---

HTTP Attack Requests — multi-class

Real HTTP requests labelled with the web-attack class carried in the request, for training and evaluating request/payload classifiers (WAF / DAST style).

Classes (7)

normal, sqli, xss, ssrf, ssti, lfi, traversal (IDOR is intentionally excluded — it's an access-control flaw with no payload signature.)

How it was built (and why it's shortcut-resistant)

Every example is a full HTTP request built on the same real envelopes (CSIC 2010 normal requests). For attack classes, one query-param value is replaced with a real attack payload; normal keeps its real benign value. The `Host`/domain is randomised on every request. So neither request structure nor domain can be used as a shortcut — the only signal is the injected value. This is a deliberate guard against shortcut learning.

Provenance

Splits

Balanced: 1000 per class across all splits combined.

Usage

from datasets import load_dataset
ds = load_dataset("SecureAI-SE/http-attack-requests")
print(ds["train"][0])   # {'request': 'GET /...', 'label': 2}
ds["train"].features["label"].names   # ['normal','sqli','xss','ssrf','ssti','lfi','traversal']

Intended use & ethics

For authorised security research, WAF/IDS training, and education. It contains real attack payloads; do not use them against systems you do not own or have permission to test.

Built for the Fine-Tuning LLMs for Security Engineers course (Secure AI).