Identify attacks against webservers via simple rules