The invention belongs to the technical field of the 
Web application protection, and discloses a multi-mode 
Web application protection method based on Mshield 
machine learning. The method comprises the following steps: extracting features through a semantic analysis unit, transmitting to a 
machine learning unit to recognize, and applying a 
random forest algorithm and a logic regression 
algorithm; effectively distinguishing hostile 
attack from a normal access request, and immediately intercepting the 
attack, wherein the Mshield cloud platform screens logs reported by the device everyday and them summarizes to place in a 
database as the iteration and a 
data set for improving the 
algorithm effect; performing deduction according to the past security posture, predicting the possible 
attack event and an application easy to be attacked in future. By acquiring the features of 
mega attack load data, through the training and the generalization of a 
machine learning model, the Mshield is more efficient and 
safer protection capacity in the face of the current even the unknown 
Web attack in future in comparison with the traditional WAF.