This paper describes a novel framework for intrusion detection systems used for Web security. A hierarchical structure was proposed to gain both server-based detection and network-based detection. The system consists of three major components. First, there is a host detection module (HDM) in each web server and a collection of detection units (UC) running on background in the host. Second, each subnet has a network detection module (NDM), which operates just like a HDM except that it analyzes network traffic. Finally, there is a central control detection module (CCDM), which is served as a high level administrative center. The CCDM receives reports from various HDM and NDM modules, and by processing and correlating these reports to detect intrusions. Detection rules are inductively learned from audit records and distributed to each detection modules in the CCDM.