harshkh/cyber-attack-classifier

🛡️ HoneyMesh Attack Classifier

Transformer-Based Multi-Class Web Attack Classification

📌 Overview

The HoneyMesh Attack Classifier is a fine-tuned Transformer-based model designed to classify malicious web payloads into specific web attack categories.

Unlike traditional rule-based Web Application Firewalls (WAFs) that rely on static signatures or regex matching, this model leverages contextual embeddings to understand the structure and intent behind malicious inputs.

The model is built on DistilBERT and optimized for balanced multi-class classification across common web exploitation vectors.

🎯 Supported Attack Classes

The model classifies payloads into the following categories:

🧠 Model Architecture

This classifier learns contextual token relationships instead of relying on keyword triggers, enabling structured attack pattern recognition.

📊 Performance

• —✅ High validation accuracy on balanced validation set
• —✅ Optimized weighted F1-score across all classes
• —✅ Strong class separability (validated via confusion matrix)
• —✅ No majority-class bias due to balanced training data

⚠️ Note: Performance reflects evaluation on structured synthetic security payload data. Real-world robustness may vary depending on payload obfuscation and adversarial techniques.

🔍 Example Usage

Install Dependencies

pip install torch transformers

Load the Model

from transformers import DistilBertTokenizerFast, DistilBertForSequenceClassification
import torch

model_name = "your-username/attack-classifier"

tokenizer = DistilBertTokenizerFast.from_pretrained(model_name)
model = DistilBertForSequenceClassification.from_pretrained(model_name)

model.eval()

payload = "' OR 1=1 --"

inputs = tokenizer(payload, return_tensors="pt")

with torch.no_grad():
    outputs = model(**inputs)

probs = torch.nn.functional.softmax(outputs.logits, dim=1)
predicted_class = torch.argmax(probs, dim=1).item()

print("Predicted Attack:", model.config.id2label[predicted_class])

🏗️ Design Philosophy

This classifier is part of the larger HoneyMesh layered security architecture, which follows:

1. 1.Payload capture via honeypot
2. 2.Binary detection filter (fast screening)
3. 3.Transformer-based multi-class classification
4. 4.Structured threat logging and analytics

The system focuses on attack attribution, not just binary detection.

🔐 Why Transformer-Based Detection?

Traditional security systems rely on:

• —Regex rules
• —Signature databases
• —Static keyword matching

This model instead:

• —Learns contextual embeddings
• —Understands structured exploit patterns
• —Generalizes across minor payload variations
• —Supports future adversarial robustness improvements

⚠️ Limitations

• —Trained on structured synthetic payload datasets
• —Obfuscation-heavy attacks may require additional augmentation
• —Not yet benchmarked against large-scale real-world traffic

🚀 Future Improvements

• —[ ] Adversarial payload augmentation
• —[ ] Robustness benchmarking
• —[ ] Ensemble detection with anomaly scoring
• —[ ] Real-time streaming inference integration

👥 Authors

Harshvardhan Khaitan

Amey Sharma