HYBRID CYBERSECURITY STRATEGIES FOR WEB APPLICATIONS USING ARTIFICIAL INTELLIGENCE

Abstract

Web applications form the foundation of most digital services and remain primary targets for SQLi, XSS, CSRF, IDOR, SSRF, and DDoS attacks. The expansion of cloud technologies and API-driven architectures increases risk, while artificial intelligence (AI) offers new opportunities for detection and response. This article examines a reproducible security framework that maps the OWASP Top 10 risks to protocol-dependent control measures and supplementary AI signals, clarifying where AI adds the greatest value without incurring excessive operational costs. The study presents a structured review of OWASP recommendations, industry reports, and academic research (including HTTP request embeddings, online anomaly detection, and graph neural networks). It defines comparative criteria emphasizing attack coverage, precision-recall for imbalanced data, false positive rate, and detection latency—illustrated through practical examples of “baseline controls + AI monitoring.” The paper aligns common web threats with fundamental protection elements (validation, CSP, parameterized queries, MFA, SameSite and short-lived tokens, WAF, TLS/HSTS, and egress restrictions) and AI applications (HTTP embeddings, session/behavioral features, log sequence models). It recommends precision-recall and streaming metrics such as NAB for early and accurate alerts. Reported operational benefits include fewer account takeovers, approximately 60% fewer false positives, around 40% faster investigations, and prevention of large-scale data breaches when AI complements established controls. AI strengthens—but does not replace—baseline defense mechanisms. A hybrid strategy is recommended: maintain a strong foundational security posture, integrate high-quality AI signals via SIEM/SOAR, and invest in MLOps, interpretability, and privacy-preserving learning. Future work should focus on web-specific tests and rigorous, reproducible evaluations to bridge the gap between research and practical deployment.

Keywords: web security, OWASP Top 10, artificial intelligence/machine learning, anomaly detection, attack classification, WAF, SIEM/SOAR, HTTP embeddings, graph neural networks.