An Improved Feature Extraction Approach for Web Anomaly Detection Based on Semantic Structure

<div>The difference of kernel density estimate (KDE) of length between all values and values of an example trivial logical part. (a) The KDE of length for all request values. (b) The KDE of length for request values for an example trivial logical part. It is obvious that the length distribution using semantic structure is more regular and learnt.</div>

Security and Communication Networks

fig5

Figure 5

Figure 5: An Improved Feature Extraction Approach for Web Anomaly Detection Based on Semantic Structure 