Method for detecting a web application attack

PURPOSE: A method for detecting a web application attack is provided to analyze a content of recombined HTTP traffic by using a parser and determine the content related to attack, thereby reducing a wrong detection rate. CONSTITUTION: A web application firewall analyzes recombined HTTP traffic(504). If the recombined HTTP traffic does not includes the content related to attack, the web application firewall transmits the recombined HTTP traffic(506.508). If the recombined HTTP traffic includes the contents related to attack, the web application firewall detects attack. The web application firewall reprocesses the recombined HTTP traffic of abnormality(510).