DEVELOPMENT OF A LIGHTWEIGHT HYPERTEXT TRANSFER PROTOCOL (HTTP) TRAFFIC ANOMALY DETECTION SYSTEM USING DECISION TREES

This research investigates the growing threat of HTTP-based cyberattacks and the limitations of traditional intrusion detection mechanisms in addressing them. Chapter One establishes the background of the study by highlighting the widespread use of the Hypertext Transfer Protocol (HTTP) in modern web applications and its increasing exploitation through attacks such as SQL injection, crosss-site scripting, and denial-of-service. The problem statement identifies the inadequacy of signature-based systems in detecting zero-day and evolving threats, while also noting the trade-off between accuracy and interpretability in advanced machine learning models. The aim of the study was therefore to develop an interpretable and computationally efficient HTTP traffic anomaly detection system using the Decision Tree algorithm. The significance, objectives, and scope of the research were clearly defined, focusing on application-layer HTTP anomaly detection within a controlled experimental environment. Chapter Two presents a comprehensive review of related literature and theoretical foundations. The cybersecurity threat landscape was examined, emphasizing the vulnerabilities inherent in HTTP communication and the evolving sophistication of web-based attacks. Various intrusion detection approaches, including signature-based, anomaly-based, and hybrid systems, were critically analyzed. The role of machine learning in intrusion detection was explored, comparing supervised, unsupervised, and deep learning techniques. Particular emphasis was placed on Decision Trees due to their interpretability, efficiency, and suitability for structured traffic data. The chapter identified research gaps, especially the limited focus on interpretable HTTP anomaly detection models tailored specifically to web traffic features, thereby justifying the direction of the present study. Chapter Three details the methodology adopted in developing the anomaly detection system. The Spanish National Research Council CSIC 2010 HTTP dataset was utilized as the experimental dataset, containing both legitimate and malicious HTTP requests. A structured vi workflow was implemented, including data preprocessing, feature engineering, model training, and evaluation. Relevant HTTP features such as request method, URL length, payload size, and suspicious keyword indicators were extracted and transformed into numerical representations suitable for machine learning. The Decision Tree classifier was trained using an 80–20 train-test split with stratified sampling to ensure balanced class representation. The system architecture was designed in a modular format, incorporating traffic input handling, preprocessing, classification, filtering, and a graphical user interface for operational usability. Chapter Four presents and discusses the results obtained from system implementation and evaluation. The developed detection engine successfully classified HTTP traffic into normal and anomalous categories using metrics such as accuracy, precision, recall, and F1-score. The model demonstrated strong detection capability for common web-based attacks while maintaining computational efficiency and interpretability. The graphical interface displayed flagged anomalies clearly and supported export functionality for further analysis. The results confirm that a Decision Tree–based approach provides a practical and transparent solution for HTTP traffic anomaly detection, balancing detection performance with operational feasibility. Overall, the findings validate the suitability of lightweight, interpretable machine learning models for enhancing web application security.