document: A general framework for adaptive and online detection of web attacks Detection of web attacks is an important issue in current defense-in-depth security framework . In this paper , we propose a novel general framework for adaptive and online detection of web attacks . The general framework can be based on any online clustering methods . A detection model based on the framework is able to learn online and deal with `` concept drift '' in web audit data streams . Str-DBSCAN that we extended DBSCAN to streaming data as well as StrAP are both used to validate the framework . The detection model based on the framework automatically labels the web audit data and adapts to normal behavior changes while identifies attacks through dynamical clustering of the streaming data . A very large size of real HTTP Log data collected in our institute is used to validate the framework and the model . The preliminary testing results demonstrated its effectiveness .
doc_bio_tags: O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O