Igino Corona and Davide Ariu and Giorgio Giacinto, "HMM-Web: a framework for the detection of attacks against Web applications", IEEE ICC 2009. Anomaly detection of server-side web attacks based on Hidden Markov Models (unsupervised learning).
- You may download that paper from: http://prag.diee.unica.it/pra/system/files/Corona_ICC2009.pdf These scripts may be used by other researchers, or by security administrators who want to easily find web application attacks, given a set of access_log files from Apache. Enjoy!
hmm-web-attacks works great