The aim of this thesis was to investigate whether HTTP sessions reconstructed from server-side logs
can be clustered according to their behavioral properties. The study focused on patterns that emerge
when multiple requests are considered as a collective sequence, instead of isolated events. This shift
from request-level inspection to session-level analysis allows a better understanding of user behavior
and helps distinguish genuine navigation from automated or suspicious interactions. \\[6pt]
The first contribution of this work concerns the reconstruction of sessions from raw traffic data.
Since Sicuranext logs do not contain any explicit session identifier, the use of IP address and
User-Agent was adopted as a practical compromise. This method is not perfect, but it was sufficient
to perform exploratory analysis, to extract features, and to evaluate the feasibility of clustering.
The second contribution lies in the construction of a feature set designed to characterize sessions.
Alongside well-known indicators such as request frequency or ratio of HTTP methods, additional
signals were introduced, including Sec-Fetch headers and response content categories. These
features provided valuable context and helped capture differences between human-driven requests
and automated behavior. \\[6pt]
To assess whether clustering was meaningful, the Dip Test was applied. Although this statistical
test operates in one dimension, it enabled the identification of multimodal structure through
dimensionality reduction or distance-based formulations. Only when sufficient evidence of
clusterability was observed did the analysis proceed. Classical clustering methods, mainly
Self-Organizing Maps and K-Means, were adopted due to the moderate dimensionality of the
dataset. While both methods have limitations, they produced coherent clusters that could be
interpreted in practical contexts. Finally, the semantic interpretation of clusters confirmed the
presence of distinct behavioral groups and provided initial labels that may be used in subsequent
supervised learning tasks.

\section*{Closing Remarks}
The results of this study demonstrate that unsupervised learning can extract meaningful behavioral
patterns from HTTP sessions using only server-side information. Even without advanced session
identification or deep learning techniques, the selected models were able to highlight clear
differences between types of user activity. Feature selection played a central role: the combination
of classical statistical indicators and less explored metadata, such as Sec-Fetch headers, helped
distinguish genuine navigation flows from automated or stealth interactions. Although the work
does not deliver a production-ready system, it lays a solid foundation for future development and
shows that clustering is a valid first step toward automated threat detection.

\section*{Future Improvements}

Several directions may enhance the effectiveness of this approach. First, the session identification
method should be refined. Reliance on IP and User-Agent introduces fragmentation and mixing
effects, especially in the presence of NAT, VPNs, or User-Agent rotation. Techniques such as
browser fingerprinting, dedicated cookies, or persistent identifiers could provide more stable
session boundaries.  \\[6pt]
Second, the clustering stage may benefit from more advanced models. Deep clustering, autoencoders,
or contrastive representation learning could better capture non-linear patterns and reduce noise in
highly heterogeneous traffic. These approaches may also help deal with edge cases where classical
methods show instability. \\[6pt]
Third, the labeling process could be reinforced. While manual labeling is time-consuming, and
cloud-based LLMs raise privacy and security concerns, a local large language model could be
fine-tuned on representative sessions and used to produce labels without exposing sensitive traffic
data outside the protected environment. This would help automate semantic interpretation while
preserving confidentiality and regulatory compliance. \\[6pt]
Finally, the labeled clusters derived in this work provide a starting point for supervised learning.
Models such as decision trees or gradient boosting could be trained to classify sessions in real
time. When doing so, latency, interpretability, and robustness against adversarial manipulation
must be considered, since threats often evolve to evade detection. \\[6pt]
Deploying the approach in a controlled production environment would also provide essential
feedback. Factors such as model drift, changing traffic patterns, and operational constraints
cannot be fully evaluated offline. Continuous monitoring, retraining strategies, and integration
with existing logging or alerting systems are necessary to maintain the long-term effectiveness
of session-based detection.
