On the Internet, web servers are often the main interface between companies or individuals and the rest of the world. As a result they represent valuable targets for attackers. Although several types of attacks are possible against web server we focus in this paper on flooding based denial of service attacks. We explore the detection of saturation attacks against web servers as well as the precise identification of attack participants. Compared to other approaches this model provides improved detection capability for focused attacks.