A Hybrid Deep Learning and Attention Fusion Framework for Intelligent Zero-Day Threat Detection in Cloud Web Application Firewalls

This research work introduces the Hybrid Deep Learning Framework (HDLF), a three-tier intelligent Web Application Firewall designed to overcome the inability of traditional signature-based WAFs to detect zero-day exploits, polymorphic SQL injection, and advanced persistent threats. HDLF combines a CNN branch for spatial payload features, a BiLSTM branch for temporal sequential attack patterns, and an Isolation Forest with adaptive dynamic thresholding for unsupervised anomaly detection, fused through a cross-modal multi-head attention mechanism and supported by an automated 247-feature extraction pipeline that removes manual feature engineering. Evaluated across five datasets (CSIC 2010, UNSW-NB15, a 10-million-request Cloudflare corpus, a 15,000-variant zero-day set, and a 30,000-request API dataset), it reports 99.2 ± 0.12% accuracy, a 2.31 ± 0.18% false-positive rate, 8.7 ms average inference latency, and 114,000 requests/second throughput, with gains over all baselines significant at p < 0.001 (Wilcoxon signed-rank), 94% detection of 847 synthetic zero-day variants, and an estimated 71–78% cost saving versus commercial WAFs—demonstrating a scalable, explainable solution for enterprise cloud security.