Fine-Tuned CodeBERT for Web Threat Classification using Agentic Reasoning

Abstract SQL injection (SQLi) and cross-site scripting (XSS) are among the most serious vulnerabilities of web applications. Existing detection approaches often need considerable time and memory to reach high accuracy, and most treat the two attacks separately. We fine-tune CodeBERT, a transformer pre-trained on source code, to detect both attacks from raw payload text and compare it with BERT-base, RoBERTa-base and DistilBERT under one identical configuration. CodeBERT misclassified 7 of 6,259 test samples (error rate 0.11%), against 0.13% to 0.19% for the other models, and a shorter input of 64 tokens cut training time by 42% and latency by 46%. One model therefore covers both attacks at low cost, which suits lightweight web application firewalls; this binary (benign vs. malicious) study is the first step towards attack-type classification.