HTTP Request Clustering for Automated Threat Detection

This work explores session clustering to analyze web traffic, treating each session as a sequence of user requests. Using unsupervised machine learning, it aims to uncover behavioral patterns useful for identifying navigation habits, anomalies, and potential attacks. The proposed method clusters and labels web sessions using only server-side HTTP logs, relying on headers and aggregated features to distinguish between normal and malicious activities. The implementation, developed in Python using data from Elasticsearch, employs Large Language Models (LLMs) alongside manual analysis to interpret and verify the resulting clusters.