Abstract
In this paper, we propose an incremental subspace clustering method for flexibly detecting hostile accesses to a Web site. Typical log data for Web accesses are huge, contain irrelevant information, and exhibit dynamic characteristics. We overcome these difficulties through data squashing, subspace clustering, and an incremental algorithm. We have improved, by modifying its data squashing functionality, our subspace clustering method SUBCCOM so that it can exploit previous results. Experimental evaluation confirms superiority of our I-SUBCCOM in terms of precision, recall, and computation time.