Abstract: A method of processing web requests directed to a website includes, at a system for processing web requests: (i) for each of a plurality of web requests directed to a website, determining a request vector corresponding to the web request, wherein each request vector represents multiple predetermined features of the respective web request; (ii) clustering the request vectors by respectively assigning each request vector to one of a plurality of clusters using a clustering algorithm; (iii) repeatedly updating the clustering of request vectors using the clustering algorithm such that the plurality of clusters dynamically change over time; (iv) monitoring cluster metadata associated with each cluster as the plurality of clusters dynamically change over time, (v) identifying, based on monitoring, any cluster meeting a predetermined anomaly criterion indicating that the cluster is displaying anomalous behaviour; and (vi) triggering an investigation of a cluster identified as meeting the predetermined anomaly criter