The present disclosure provides a detection system, comprising a client for unloading malicious HTTP traffic and a server for receiving and detecting the malicious HTTP traffic, wherein the server comprises an active label corrector for correcting noisy labels of the malicious HTTP traffic and a multi-field feature extractor for automatically discovering underlying features of the malicious HTTP traffic.