Augmenting SR-BH 2020: A Technical Methodology for Modern Threat Simulation

High-quality security datasets are essential for training and benchmarking modern Web Application Firewalls (WAFs). Since WAFs and ML-based defenses rely heavily on training data, gaps in dataset diversity or accuracy can directly weaken real-world protection. While SR-BH 2020 remains a widely referenced dataset, its limitations in diversity, labeling accuracy, and alignment with today’s threat landscape prompted a deeper enhancement initiative.

This blog post will walk through a full-scale enhancement of the SR-BH 2020 dataset. The process included cleaning mislabeled data using LLMs, introducing modern threat classes mapped to the OWASP Top 10, generating structurally diverse benign traffic, and creating targeted attack payloads using custom Burp Suite configurations. This methodology resulted in an upgraded version of SR-BH 2020 that better reflects current attack patterns and backend diversity, and one that has since been put to the test in WAMM (Web Attack Multi-classification Model), a published research project, where it served as the foundation for training and evaluating a real-time ML-based attack detection system.

Initial Audit and Label Refinement

The original SR-BH 2020 dataset, containing a total of 907,816 HTTP requests, was first audited. During the review, it was discovered that many rows labelled as “benign” were mislabeled, as shown in Figure 1, and contained malicious payloads.

To ensure accuracy, a three-step process was followed:

1. Automated Script Pass: A Python script was run to detect and flag obvious mislabeled entries.
2. LLM-Based Classification: The Qwen3-8B (Q4_K_M quantization) model was applied to identify additional mislabeled requests and streamline the label taxonomy, aligning categories with the OWASP Top 10.
3. Manual Review: Flagged entries were randomly sampled and manually inspected to verify LLM output and remove false positives.

The final structure included these categories:

• Normal
• OS Command Injection
• Path Traversal
• SQL Injection
• Command Injection
• Cross-Site Scripting (XSS)
• Server-Side Template Injection (SSTI)
• Code Injection
• Server-Side Request Forgery (SSRF)

Enhancing the Benign Dataset with Backend Diversity

The original dataset was skewed heavily toward PHP-based WordPress traffic, limiting generalization for broader security model training. To diversify, benign traffic was captured as shown in Figure 2 from live websites built using varied stacks, including Node.js, Django, Flask, and ASP.NET.

Sites were selected according to a specific set of criteria: each had to be public, crawlable, and HTTPS-enabled, built on a different backend technology than the others already captured, and contain dynamic routes, forms, or API endpoints that could generate realistic, stateful traffic.

Rather than relying on static or synthetic data, automated crawlers that simulate real user sessions across platforms like Amazon and Khan Academy were built. This traffic was routed through Firefox and FoxyProxy into Burp Suite Pro, intercepting HTTPS requests as they happened to capture the full complexity of stateful web interactions. Lastly, Logger++ acted as the flight recorder, ingesting every request header, response body, and timing detail into a highly detailed stream of production-grade data.

Deduplication via MinHash Filtering

Maintaining an efficient and diverse database required applying deduplication. This step was crucial to filter out the repetitive information naturally generated by automated crawling tools, allowing us to strip away redundant noise and populate the database with only unique, high-value behavioral samples.

A MinHash + Locality-Sensitive Hashing (LSH) pipeline was used to eliminate near-duplicate benign requests for the malicious request generation step. Each request was tokenized and hashed to generate similarity signatures. Only requests with no significant overlap (above threshold) were retained.

Modular Attack Injection with Custom Burp Scan Plans

With the database now populated by legitimate user interactions, the focus was shifted to the adversarial side. OWASP Top 10 attack patterns, SQL injection, XSS, authentication bypasses, and more, were injected to create a dataset that reflects both normal and malicious traffic.

Targeted attack types were simulated using custom Burp Suite configurations, with each configuration dedicated to a single attack category. This setup ensured clean labeling (e.g., “attack_type”: “SQLi”), no overlapping payloads within the same request, and balanced dataset partitions across attack types.

Scan Flow:

1. Load SR-BH Benign Requests

   a. A Python script was used to automatically replay benign HTTP requests from the SR-BH 2020 dataset into Burp Suite via its proxy.
   b. Each request was parsed from the full_http_request column in the CSV file and reconstructed with appropriate headers, HTTP method, and body.
   c. A fire-and-forget approach was employed to send requests without waiting for responses, enabling fast batch processing.
   d. The script supported multiple HTTP methods (GET, POST, PUT, etc.) and routed all traffic through a local Burp proxy at http://127.0.0.1:8080.
   e. This setup allowed Logger++ in Burp to silently capture and log each request, essential for running isolated active scans in the next phase.

2. Run Targeted Active Scans

   a. Each scan was executed using a single-issue Burp configuration (e.g., only SQL Injection) as seen in Figure 3.
   b. This modular approach ensured clean targeting per vulnerability type.

3. Extract and Save Outputs

   a. Modified requests and payloads were extracted using Logger++.
   b. Outputs were saved to CSV files, with one file per vulnerability type, preserving clear separation and traceability.

Each configuration was designed to focus on a single attack family, as illustrated in Figure 4 below:

• Config Name: TEST - 66 - SQLi
• Issues Enabled:
  • SQL Injection
  • SQL Injection (Second Order)

This modular setup was repeated for other attack types, including Cross-Site Scripting (XSS), OS Command Injection, Code Injection, Path Traversal, Server-Side Template Injection (SSTI), Server-Side Request Forgery (SSRF), and others.

Final Output and Format

Sample logged requests generated during SQLi injection scans are shown in Figure 5 below:

Dataset Versioning Strategy: DS-Augmented

To enable flexible downstream use cases and accommodate varying fidelity requirements for WAF training and ML model evaluation, the project was organized into a clear versioning scheme.

As seen above, Figure 6 traces the full path: the original SR-BH 2020 dataset is cleaned into DS-Base by removing mislabeled benign entries via LLM validation. After diversifying and deduplicating its benign traffic, this foundation is subjected to targeted Burp Suite Pro active scans on unique requests to generate the raw DS-Augmented-v1. Finally, a targeted LLM-based filtering pass strips out noisy, probing-only requests to retain strictly high-confidence, fully formed exploit payloads, yielding DS-Augmented-v2.

These datasets are now available for the community to use in their own WAF research and model development via their public GitHub repository.

Key Takeaways

This SR-BH 2020 update modernizes the dataset to reflect today’s threat landscape: the taxonomy now aligns with current OWASP classifications, controlled per-category scans with custom Burp Suite configurations replaced noisy broad scanning to sharpen label precision, structurally diverse benign traffic was sourced from real applications for realistic baselines, MinHash-based deduplication cut bias and improved generalizability, and LLM-assisted relabeling corrected mislabels that manual review tends to miss.

The real test was whether this held up downstream, and it did. These refined datasets became the foundation for WAMM, our published research project, which significantly outperformed traditional rule-based WAFs in detecting web attacks. This shows that curated, rigorously enhanced training data is what makes real-time, resilient WAF detection possible.