In view of the problem that most of the Web application fi rewalls detect malicious HTTP queries based on rules

which leads to easy bypass and low detection effi cient

an abnormal malicious HTTP queries identifi cation method based on BoW model clustering is proposed. By means of BoW and TF-IDF for existing abnormal queries and normal queries

it extract feature of HTTP queries. XGBoost classifi cation algorithm is used to detect abnormal traffi c. The experimental results show that this method has better recognition effect of abnormal queries compared with identification method based on random forest

support vector machine and others.