Characterizing Anomalies in Malware-Generated HTTP Traffic

Figure 3

An example of assigning HTTP requests into request groups based on the Snort ID rules reported by this IDS.