An Improved Feature Extraction Approach for Web Anomaly Detection Based on Semantic Structure

Table 1

Four examples of URL and each URL represents a type of HTTP requests.

No.	URL	Parameter sequence	Semantic structure
1	/question/search?q = docker	Path 1, Path 2, q	question/search?q =
2	/question/top?q = windows server &page = 10	Path 1, Path 2, q, page	question/top?q = &page =
3	/user/news?page = 1	Path 1, Path 2, page	/user/news?page =
4	/teams/create/Linux	Path 1, Path 2, Path 3	/teams/create/

Parameter sequence is the parameter-sequence extracting from and . Semantic structure is the semantic structure information of each type of HTTP requests. The “” in semantic structure denotes the corresponding part is trivial, and other symbols mean the corresponding segments are salient.