  Web request query strings (queries), which pass parameters to the referenced
resource, are always manipulated by attackers to retrieve sensitive data and
even take full control of victim web servers and web applications. However,
existing malicious query detection approaches in the current literature cannot
cope with changing web attacks with constant detection models. In this paper,
we propose AMODS, an adaptive system that periodically updates the detection
model to detect the latest unknown attacks. We also propose an adaptive
learning strategy, called SVM HYBRID, leveraged by our system to minimize
manual work. In the evaluation, an up-to-date detection model is trained on a
ten-day query dataset collected from an academic institute's web server logs.
Our system outperforms existing web attack detection methods, with an F-value
of 94.79% and FP rate of 0.09%. The total number of malicious queries obtained
by SVM HYBRID is 2.78 times that by the popular Support Vector Machine Adaptive
Learning (SVM AL) method. The malicious queries obtained can be used to update
the Web Application Firewall (WAF) signature library.
