WEB services have increasingly been adopted nowadays and therefore been targeted by attackers. The underlying technologies used by them bring known vulnerabilities to this new environment. The classical approach for attack detection either produce high false positive detection rates or cannot detect attack variations − leading to zero-day attacks. This paper applies ontology to build a strategy-based knowledge attack database. It is a novel hybrid attack detection engine, bringing together the main advantages of signature and knowledge-based classical approaches. Moreover, it is capable of mitigating zero-day attacks for XML injection, with no false positive detection rate.