The web environment security has become a high priority for e-businesses communities. As the usability and popularity of web applications have increased, various types of attacks in web applications also increase. The Intrusion detection system has been used for the purpose of detecting the attacks by looking at the network traffic or by looking at operating system events. Log-based intrusion detection system makes use of user logs from the web servers, where the access information about each and every request is saved. The drawback of Log-based web intrusion detection is that it can be executed only after transactions take place; hence, the prevention of attack is unattainable. In this paper we are focusing on user’s behavior, to find out the difference between the common user and malicious user and try to prevent the attack before it takes place