Embodiments of the present disclosure relate to detecting new attack vectors in web application servers based on analyzing requests (e.g., HTTP/S requests) that were flagged as attacks by a machine learning web application firewall (ML WAF) but not by a rule-based WAF. Such requests may be grouped together using a clustering algorithm, and the features that are determined as being high contributors to an overall attack probability in a threshold number of such requests may be used to determine new attack vectors.