An Improved Feature Extraction Approach for Web Anomaly Detection Based on Semantic Structure

Figure 3

The processing of learning semantic structure and constructing pattern-tree. We first separately learn semantic structure and construct pattern-tree on each subgroup. Then, we merge these independent semantic structures into an entire pattern-tree which describes the whole semantic structure of Web application. The entire pattern-tree is used in building the anomaly detection model and detecting malicious.