To achieve the objectives of this study, the following challenges are addressed:
\begin{itemize}
    \item Session Identification
    \item Feature Identification
    \item Exploratory Feature Analysis
    \item Selection of Appropriate Clustering Algorithms
    \item Labeling
\end{itemize}
These steps are essential for structuring the analysis. For this reason, the current state of the art related to each challenge is reviewed.
\section{Session Identification} \label{session-identification}
The purpose is to aggregate requests issued by the same user in order to enable further analysis on the resulting sessions. 
In \cite{wsad-an-unsupervised-web-session-anomalydetection-method}, sessions are reconstructed by grouping consecutive requests originating from the same IP address within a fixed time window of ten minutes. 
Similarly, \cite{unsupervised-clustering-of-web-sessions-to-detect-malicious-and-non-malicious-website-users} adopts a time-based approach but relies on the combination of IP address and User-Agent to identify a user. \\[6pt]
Using only the IP address raises the well-known NAT issue: when several devices share the same public address, their requests may be incorrectly merged into a single session. Although combining IP address and User-Agent reduces this risk, it does not eliminate it entirely. \\[6pt]
Both approaches can also be easily bypassed. In the first case, rotating the IP address forces the system to create a new session for each request. In the second case, frequently modifying the User-Agent string leads the system to interpret a continuous browsing activity as several independent sessions.
\begin{description}
    \item[Strengths:] Straightforward to deploy, as both the IP address and the User-Agent string are available on the server-side.
    \item[Weaknesses:] Susceptibility to IP rotation and/or User-Agent rotation.
\end{description}
These issues motivate the investigation of appropriate mitigation techniques. 
One such approach is browser fingerprinting, which generates a device-specific identifier and assigns incoming data to this identifier rather than relying solely on the IP address or the User-Agent header. 
This identifier is derived from high-entropy attributes of the client environment that tend to remain stable over time, enabling reliable re-identification of the same device across multiple sessions and, in some cases, across different websites.
The survey in \cite{a-survey-of-browser-fingerprint-research-and-application} offers a comprehensive overview of browser fingerprinting. It outlines the main fingerprinting techniques, examines the associated privacy implications, and reviews existing work on fingerprint randomization. In particular, the authors of \cite{a-large-scale-measurement-study-and-classification-of-fingerprint-dynamics} and \cite{beyond-the-crawl-unmasking-browser-fingerprinting-in-real-user-interactions} describe how several JavaScript APIs can be leveraged to construct such fingerprints, for example, the \texttt{canvas} API, which exposes differences in font rendering; the canvas font list, which reveals installed fonts; \texttt{WebRTC}, which can disclose peer information; and the \texttt{AudioContext} API, which uncovers hardware-dependent variations in audio processing.
Interestingly, even subtle rendering differences, such as those observed in system-provided emojis, can contribute to a browser's uniqueness. These variations may also disclose sensitive information, including the presence of specific software or the absence of certain security patches. \\[6pt]
Beyond improving session identification, browser fingerprinting can also assist in detecting automated traffic. Many bots attempt to evade detection by deliberately altering parts of their fingerprint, which often creates inconsistencies among collected attributes \cite{fp-inconsistent-measurement-and-analysis-of-fingerprint-inconsistencies-in-evasive-bot-traffic}. For example, a request may include a User-Agent string identifying the device as an iPhone while reporting the absence of touch capabilities, a combination that is impossible on genuine hardware. Likewise, a device claiming to be mobile may report a screen resolution typical of a desktop system, contradicting the declared platform. Detecting such inconsistencies not only helps distinguish human traffic from evasive bots but also strengthens the reliability of session association. \\[6pt]
However, some browsers, such as Brave, already include built-in mechanisms that reduce fingerprinting. In addition, adopting this approach requires modifications to the client source code and the collection of a broad set of client information for fingerprint generation, a process that is technically complex and raises privacy concerns.
\begin{description}
    \item[Strengths:] Provides robust session identification without relying on the IP address or the User-Agent, both of which are relatively easy to bypass.
    \item[Weaknesses:] Requires substantial development effort and careful attention to detail during implementation.
\end{description}
An alternative method is presented in \cite{tales-of-favicons-and-caches-persistent-tracking-in-modern-browsers}, where the authors track users by exploiting favicons to create persistent identifiers. The favicon cache (F cache) is a dedicated storage area that operates independently of the browser's main cache and is therefore not affected by clearing browsing data such as cache, history, or cookies. The identifier assigned to a user is constructed by redirecting the browser through a sequence of subdomains, each delivering a distinct favicon, which allows information to be encoded in the F cache. An $N$-bit identifier makes it possible to distinguish among $2^N$ users and requires $N$ redirections. At the time of publication, Chrome, Safari, Edge, and Brave were all susceptible to this technique. In Firefox, however, the authors reported that the browser did not load favicons from the cache, but instead requested them again, which prevented tracking. This method is capable of identifying users even when they browse through a virtual private network or in private mode. \\[6pt]
Although the mechanism is appealing from a theoretical perspective, it is not practical in real deployments because the required sequence of redirections introduces a substantial performance cost. \\[6pt]
\begin{description}
    \item[Strengths:] Enables persistent user identification by exploiting a cache mechanism that is unaffected by clearing browsing data and remains effective across private browsing sessions and the use of a virtual private network.
    \item[Weaknesses:] Relies on multiple sequential redirections, which introduce noticeable performance overhead and limit its practicality in real-world deployments.
\end{description}
A different approach is proposed in \cite{botsbfuod-web-bot-detection-using-biometric-features-and-unsupervised-outlier-detection}, where requests are grouped into sessions by relying on the Google Analytics Client ID. When a user visits a website that has Google Analytics enabled and is logged in to their Google account, the platform sets a cookie (typically named \texttt{\_ga}) that stores this identifier. This value can then be used to associate multiple requests with a single session. Variations in the user's IP address or User-Agent string do not interfere with this process, because the Client ID remains stable across such changes.
\begin{description}
    \item[Strengths:] Provides a stable session identifier that remains consistent across changes in IP address and User-Agent, allowing reliable association of requests without requiring server-side state management.
    \item[Weaknesses:] Depends on the presence of Google Analytics and the acceptance of the corresponding cookie, which limits applicability in contexts where tracking protection, cookie restrictions, or user consent policies prevent the Client ID from being set or retained.
\end{description}
A methodology closely related to the previous technique is the use of a dedicated cookie. In this approach, the server assigns a unique identifier to the client and stores it in a cookie that is sent with subsequent requests. As long as the cookie remains stored in the browser, the identifier offers a straightforward way to associate multiple interactions with the same user across different requests.
\begin{description}
    \item[Strengths:] Simple to implement and effective for tracking, since the identifier persists across requests and does not rely on network characteristics.
    \item[Weaknesses:] Loses effectiveness when users delete their cookies, which prevents the identifier from being retained.
\end{description}
In this work, sessions are identified using the combination of IP address and User-Agent. Although this method is known to have limitations, developing a more robust identification mechanism is not the primary focus of the thesis. Nevertheless, it indicates a clear direction for future improvements, since inaccurate session identification would compromise all subsequent analyses.

\section{Feature Identification} \label{feature-identification}
It is worth remarking that only server-side features are considered, which contribute to simplifying the analysis. The study below is among those applying unsupervised learning to web session characterization.
In \cite{unsupervised-clustering-of-web-sessions-to-detect-malicious-and-non-malicious-website-users}, the authors employ two unsupervised neural network models, namely the Self Organizing Map (SOM) and the Modified Adaptive Resonance Theory 2 (Modified ART2). They select nine features, which are reported below:
\begin{enumerate}
    \item Click rate, a numerical attribute defined as the number of HTTP requests within a single session.
    \item HTML to Image ratio, a numerical attribute defined as the number of HTML page requests divided by the number of image file requests (JPEG and PNG).
    \item Percentage of PDF or PS file requests, a numerical attribute defined as the proportion of PDF or PS file requests within a session.
    \item Percentage of 4xx error responses, a numerical attribute defined as the proportion of erroneous HTTP requests in a session.
    \item Percentage of HTTP requests of type HEAD, a numerical attribute defined as the proportion of HEAD requests in a session.
    \item Percentage of requests with unassigned referrers, a numerical attribute defined as the proportion of requests with blank or missing referrer fields within a session.
    \item \textit{Robots.txt} file request, a nominal attribute equal to 1 if the \textit{robots.txt} file is requested during a session and 0 otherwise.
    \item Standard deviation of requested page depth, a numerical attribute defined as the standard deviation of the depth of the requested pages within a session.
    \item Percentage of consecutive sequential HTTP requests, a numerical attribute defined as the proportion of sequential requests for pages belonging to the same directory during a session.
\end{enumerate}
In a more recent study \cite{wsad-an-unsupervised-web-session-anomalydetection-method}, the authors detected malicious crawlers as well as attacks such as brute force password cracking. They selected ten features for anomaly detection in a session. The features include:
\begin{enumerate}
    \item Proportion of abnormal User-Agents, such as spider bots or crawlers
    \item Proportion of requests using methods other than GET or POST, such as HEAD, PUT, CONNECT, OPTIONS or PROPFIND
    \item Proportion of POST requests
    \item Access amount, defined as the total number of requests after excluding those for static pages
    \item Access frequency, measured as the number of requests per minute
    \item Number of accesses to sensitive files
    \item Browser automatic access request ratio, which represents the percentage of visits within a session generated automatically by the browser, for example requests for static resources such as js, css, png or jpeg files. This feature is similar to the HTML to Image ratio used in previous work \cite{unsupervised-clustering-of-web-sessions-to-detect-malicious-and-non-malicious-website-users}, although it is more general.
\end{enumerate}
The remaining features were the same as those used in the previous study \cite{unsupervised-clustering-of-web-sessions-to-detect-malicious-and-non-malicious-website-users}. The authors applied the DBSCAN algorithm, using Euclidean distance as the similarity metric, to identify anomalous web sessions. DBSCAN requires two parameters, MinPts and eps. They set MinPts to 11, corresponding to the ten features plus one, while the value of eps was not specified in their paper. \\[6pt]
To assess whether the proposed features provide meaningful information within the context of this thesis, Kibana visualizations can be used to examine their relevance. This approach makes it possible to determine which features actually contribute useful insights to the analysis conducted in this work.
The available logs do not include a notion of sessions, which makes it impossible to analyze the features at the session level. The construction of the sessions is therefore performed offline, within the Python scripts that preprocess the data. Nevertheless, examining individual requests can still offer insights into whether the features identified in the previous study remain useful.
\begin{figure}[H]
  \centering
  \begin{subfigure}{0.48\textwidth}
    \centering
    \includegraphics[width=\textwidth]{images/head_head-4xx}
    \caption{HEAD vs HEAD with response status code 4xx}
    \label{fig:head_head-4xx}
  \end{subfigure}
  \hfill
  \begin{subfigure}{0.48\textwidth}
    \centering
    \includegraphics[width=\textwidth]{images/options-4xx}
    \caption{OPTIONS with response status code 4xx}
    \label{fig:options-4xx}
  \end{subfigure}
  \caption{Comparison of 4xx responses for HEAD and OPTIONS requests}
  \label{fig:combined-4xx}
\end{figure}
\noindent
On the thirteenth and fourteenth of November, nearly all HEAD requests resulted in response codes of the 4xx class, most frequently 403 Forbidden and 404 Not Found. During this period, the volume of HEAD requests was noticeably higher than on the other days of the week. This concentration of erroneous HEAD requests suggests that their occurrence may serve as an indicator of automated threat activity, since attackers often employ HEAD requests to remain covert, retrieving only response headers rather than full content. \\[6pt]
A similar pattern is observed in the number of OPTIONS requests on the tenth of November. This indicates that not only HEAD requests but also OPTIONS requests may provide useful information. For this reason, this work focuses more generally on non-GET and non-POST requests, as they can contribute meaningful insights when characterizing potentially automated behaviors.

\begin{figure}[H]
  \centering
  \begin{subfigure}{0.48\textwidth}
    \centering
    \includegraphics[width=\textwidth]{images/empty-referer_empty-referer-4xx}
    \caption{Empty referer with response status code 4xx}
    \label{fig:empty-referer_empty-referer-4xx}
  \end{subfigure}
  \hfill
  \begin{subfigure}{0.48\textwidth}
    \centering
    \includegraphics[width=\textwidth]{images/empty-referer-wp}
    \caption{Empty referer with URI path /wp-login.php or /wp/wp-admin/*}
    \label{fig:empty-referer-wp}
  \end{subfigure}
  \caption{Comparison of empty referer request patterns}
  \label{fig:combined-empty-referer}
\end{figure}
\noindent
In general, it is possible for requests to appear without an assigned referrer. What is unusual in the Figure~\ref{fig:combined-empty-referer}, however, is that at a regular interval of three days (9, 12, and 15 November at 9:00), there is a noticeable increase in requests with no referrer that target either the endpoint \texttt{/wp-login.php} or the paths \texttt{/wp/wp-admin/*}. When such a periodic pattern emerges, it is typically associated with some form of automated activity. For this reason, the total number of requests with an unassigned referrer may itself represent a useful feature.
\subsection{Novel Features Introduced}
A feature that is absent from the existing research is the type of content contained in each response. This idea is related to what has already been explored, for example features that compute the ratio of HTML to images or that count the number of accesses while excluding requests for static resources. Because many content types exist, this work focuses only on images, fonts, application, and text. In addition, only the main category is taken into account; for instance, responses of type \texttt{image/gif} and \texttt{image/jpeg} are not distinguished but are grouped under the image category. These features can help characterize user sessions, as several hypotheses can be formulated. For example, a session that contains no image or font requests may be considered suspicious. Although some of these resources might be retrieved from the cache, the absence of such requests can still raise suspicion. \\[6pt]
Another feature that is rarely discussed in the literature is the use of the Sec Fetch headers, which provide additional information on the context of each request. While most studies rely on traditional request headers or server-side information, and some make use of client-side signals to infer navigation behavior as shown for example in this master's thesis \cite{botsbfuod-web-bot-detection-using-biometric-features-and-unsupervised-outlier-detection}, the Sec Fetch headers remain underexplored partly because they are relatively new and not yet uniformly supported across browsers. However, the \texttt{Sec-Fetch-*} headers can be leveraged as heuristics to infer whether requests stem from direct user interactions or are automatically generated by scripts. \\[6pt]
For instance, the \texttt{Sec-Fetch-User} header typically appears in requests triggered by explicit user actions such as clicks. The \texttt{Sec-Fetch-Site} header, which indicates the relationship between the initiator's origin and the target origin, is often set to \texttt{none} when a request originates directly from a user (e.g., typing a URL or selecting a bookmark) rather than from a cross-site or same-site script. Similarly, the \texttt{Sec-Fetch-Dest} header specifies the intended destination of a request; when its value is \texttt{document}, it commonly signals a top-level navigation event initiated by the user. \\[6pt]
It is important to note that this approach is intrinsically heuristic: because these are standard HTTP headers, they can be modified by an attacker. However, when incorporated into a broader detection strategy, they provide valuable indicators for distinguishing legitimate user traffic from automated or scripted requests. \\[6pt]
(Information about the \texttt{Sec-Fetch-*} headers can be found in the official MDN Web Docs: \href{https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers#fetch_metadata_request_headers}{MDN Fetch Metadata Request Headers})
\begin{figure}[H]
  \centering
  \begin{subfigure}{0.48\textwidth}
    \centering
    \includegraphics[width=\textwidth]{images/ct-js_sfd-not-script-empty}
    \caption{Responses with content type \texttt{text/javascript} where the request \texttt{sec-fetch-dest} is not \texttt{script} or \texttt{empty}.}
    \label{fig:ct-js_sfd-not-script-empty}
  \end{subfigure}
  \hfill
  \begin{subfigure}{0.48\textwidth}
    \centering
    \includegraphics[width=\textwidth]{images/ct-html_sfd-not-document-empty}
    \caption{Responses with content type \texttt{text/html} where the request \texttt{sec-fetch-dest} is not \texttt{document} or \texttt{empty}.}
    \label{fig:ct-html_sfd-not-document-empty}
  \end{subfigure}
  \caption{Comparison of anomalous request patterns based on content type and \texttt{sec-fetch-dest} mismatches.}
  \label{fig:ct-sfd-mismatch}
\end{figure}
\noindent
When a browser retrieves a JavaScript file, and provided that the request headers have not been altered, it usually sends the header \texttt{Sec-Fetch-Dest: script}. The server response in such cases commonly specifies the content type \texttt{text/javascript}. When a response is delivered with the content type set to \texttt{text/javascript} but the \texttt{Sec-Fetch-Dest} header is absent or indicates a value other than \texttt{script/empty}, this can indicate that the request did not originate from a standard browser. Situations of this kind may reveal automated tools or scripted clients and may also correspond to specific device behavior such as certain iOS clients. A detailed analysis shows that the Safari versions reported by these requests, together with the associated iOS versions, are relatively old. This point is illustrated in the figure below.
\begin{figure}[H]
  \centering
  \includegraphics[width=1\textwidth]{images/mobile-safari-versions}
  \caption{Mobile Safari versions}
  \label{fig:mobile-safari-versions}
\end{figure}
\noindent
This behavior can be considered legitimate, because the \texttt{Sec-Fetch} header is added only starting from version 16.4. \\[6pt]
A similar observation applies to the case in which the header \texttt{Sec-Fetch-Dest: document} would be expected, as shown in Figure~\ref{fig:ct-html_sfd-not-document-empty}. When filtering requests by User-Agent version, it appears that recent versions of Chrome do not send the \texttt{Sec-Fetch-Dest} header, however, it also appears that very old versions of Chrome are present. The spike in traffic shown below is very likely produced by an automated process.
\begin{figure}[H]
  \centering
  \includegraphics[width=1\textwidth]{images/ct-html_sfd-not-document-empty_ua-versions}
  \caption{Distribution of Chrome versions}
  \label{fig:ct-html_sfd-not-document-empty_ua-versions}
\end{figure}
\noindent
The same reasoning applies to the case in which \texttt{Sec-Fetch-Dest: image} is present and \texttt{Sec\-Fetch-User: ?1} is present. Typically, when an image is requested, the \texttt{Sec-Fetch-User} header is not set. Nonetheless, as shown in Figure~\ref{fig:sfd-image_not-sfu-?1}, there are cases in which it is set. Most of these requests correspond to Chrome version \texttt{125.0.0.0}, which is suspicious, because it is a version from the previous year, although it might still be legitimate. Further investigation would be required to determine its nature.
\begin{figure}[H]
  \centering
  \includegraphics[width=1\textwidth]{images/sfd-image_not-sfu-?1}
  \caption{\texttt{Sec-Fetch-Dest: image} and \texttt{Sec-Fetch-User: ?1}}
  \label{fig:sfd-image_not-sfu-?1}
\end{figure}
\noindent
A comparable consideration applies to requests with \texttt{Sec-Fetch-Mode: navigate} and \texttt{Sec\-Fetch-Dest: script}. This combination is suspicious, because navigation requests are normally associated with a destination of \texttt{document}, which is usually triggered by direct human interaction. As already mentioned, many of these requests originate from outdated Chrome versions, which suggests the same explanation as in the previous scenarios.
\begin{figure}[H]
  \centering
  \includegraphics[width=1\textwidth]{images/sfm-navigate_sfd-script}
  \caption{\texttt{Sec-Fetch-Mode: navigate} and \texttt{Sec-Fetch-Dest: script}}
  \label{fig:sfm-navigate_sfd-script}
\end{figure}
\noindent
Moreover, a third feature requires consideration, namely the average response content length. One hypothesis regarding its usefulness is that, during periods in which attackers extract substantial amounts of data from a website, the size of the returned content increases significantly. In such intervals, the average response content length becomes unusually high, indicating that the retrieved data may be suspicious. \\[6pt]
These new features provide additional signals that go beyond the classical features used in previous studies, and they are presented in Section~\ref{implementation-approach}.

\section{Exploratory feature analysis}\label{exploratory-feature-analysis}
A survey covering two decades of research in feature analysis is presented in \cite{feature-selection-techniques-for-machine-learning-a-survey-of-more-than-two-decades-of-research}. Feature selection is a fundamental task in machine learning, as choosing appropriate features reduces dimensionality by removing irrelevant or redundant variables. It also improves model performance and enhances interpretability. However, no single technique is universally optimal. The choice depends on several factors such as dataset size, the presence of missing values, the need for interpretability, and whether the problem is supervised or unsupervised. \\[6pt]
In this work, only a limited number of features is used. These features are selected because they provide meaningful information for the task. In the unsupervised setting, several techniques discussed in the aforementioned survey are applied, including correlation analysis, variance analysis, and locality preservation. Another relevant contribution is \cite{feature-selection-a-data-perspective}, in which the authors provide a Python library implementing a wide range of feature analysis methods. \\[6pt]
This topic will be revisited when the supervised model is developed. At that stage, stronger techniques, as discussed in the cited works, will be employed to identify the most influential features in the model. In the feature analysis conducted in this work, correlation is examined, but it is worth noting that in this type of problem a correlation value around 0.9 does not necessarily justify eliminating a feature, as it may still contribute useful information for detecting suspicious sessions. The article \cite{feature-selection-techniques-for-machine-learning-a-survey-of-more-than-two-decades-of-research} also provides an overview of high-dimensional scenarios, in which the number of features is much greater than the number of samples. In the present work, the dataset contains 87942 samples and 31 features. Therefore, the problem is not considered high dimensional. Consequently, the computational complexity is lower, as no dimensionality reduction preprocessing step is required.

\section{Clustering Algorithms}
The current state of the art in clustering is known as deep clustering. Deep clustering combines deep learning with clustering, and as discussed in \cite{an-overview-on-deep-clustering, deep-clustering-a-comprehensive-review}, these approaches are well suited for handling highly complex data. They are applied in several fields, for example anomaly detection, image analysis, and other domains where non linear relationships are present. These surveys provide an overview of the main techniques. \\[6pt]
One interesting aspect is the use of autoencoders for dimensionality reduction, in which the input data are mapped to a latent space and this representation is then used for clustering. Autoencoders are capable of learning non linear structures, whereas classical dimensionality reduction methods, for instance PCA, often struggle. Another introduction to autoencoders and their use in clustering, together with comparisons between clustering on the original data and on the latent representation, is provided in \cite{an-introduction-tp-autoencoders}. \\[6pt]
As noted in Section~\ref{exploratory-feature-analysis}, the problem considered in this work is not high dimensional, therefore the use of autoencoders or deep clustering is not necessary. Instead, shallow clustering techniques are adopted. A recent review of these algorithms is presented in \cite{a-rapid-review-of-clustering-algorithms}, which describes different types of methods, including partition based, hierarchical, density based, grid based, and model based approaches. The authors examine the advantages and limitations of each method, taking into account factors such as the number of features and the size of the dataset. In this thesis, K-Means is applied with full awareness of its limitations:
\begin{itemize}
    \item Sensitive to outliers
    \item Prone to convergence to local optima
    \item Requires a predefined number of clusters
    \item Not well suited for non-convex data
\end{itemize}
Nevertheless, as noted in the literature, K-Means performs well in many applications, with the exception of domains such as image analysis and bioinformatics, where high-dimensional or complex data structures make alternative clustering approaches more appropriate. Since this is not the case in the present study, K-Means remains a relevant choice. They also discuss internal and external indices for assessing clustering quality. Section~\ref{internal-validation-indices} examines these validation metrics in more detail and discusses their limitations.

\subsection{Dip Test for Multimodality} \label{dip-test}
Clustering is only appropriate when a cluster structure is present in the data, as shown in~\cite{to-cluster-or-not-to-cluster-an-analysis-of-clusterability-methods}.
Such analysis is independent of any clustering method and should therefore precede the application of clustering algorithms. If the data do not exhibit an inherent cluster structure that can be meaningfully partitioned, clustering may not be suitable for the given data, or the data may need to be reprocessed. \\[6pt]
To identify an appropriate clusterability measure, several key properties are considered:
\begin{itemize}
    \item \textbf{Efficiency:} the measure should be computable in polynomial time
    \item \textbf{Algorithm Independence:} the measure should not depend on any specific clustering algorithm
    \item \textbf{Effectiveness:} the measure should accurately identify data as either clusterable or unclusterable
\end{itemize}
The procedure consists of two main stages: first, the dimensionality of the data is reduced, and second, a statistical test is applied to assess multimodality.  
The low-dimensional embedding helps determine how readily the dataset can be partitioned into meaningful clusters.  
When the data are generated from a single bivariate normal distribution, the observations form one cluster, and both the distribution of pairwise distances and the distribution of the first principal component exhibit a single mode.  
In contrast, if the data come from a mixture of clusters that are well separated, these distributions display multiple modes, reflecting the distinction between within-cluster variation and between-cluster separation. \\[6pt]
A common approach for dimensionality reduction is PCA, which projects the data onto orthogonal dimensions that explain most of the original variance. PCA is relatively robust but not well suited for non-linear structures, for which principal curves may be more appropriate. The pairwise-distance approach yields a one-dimensional array but increases the sample size approximately by the square of the original size; thus, for large datasets, it becomes computationally demanding. \\[6pt]
Following dimensionality reduction, multimodality tests are applied. These tests generally assume that the data are generated from a unimodal distribution, which serves as the null hypothesis. The $p$-value indicates how compatible the observed sample is with this hypothesis, in the sense that larger $p$-values reflect little evidence against unimodality, whereas smaller $p$-values provide evidence that the data deviate from a single underlying mode. When the $p$-value is large, the data are likely not separable into distinct clusters. In contrast, a small $p$-value suggests the presence of multiple modes, hence supporting the existence of several clusters in the population. It is important to note that statistical multimodality tests are designed for data in one dimension, because their asymptotic properties in higher dimensions remain insufficiently understood. \\[6pt]
In the study by Adolfsson \textit{et al.}, several multimodality tests are evaluated on both simulated and empirical datasets. Among these methods, the \textit{Dist-Dip} test shows the best performance, and it is the only procedure that recognizes chaining structures in the data, such as single lines, parallel lines, or concentric circles. 
It is important to note that the previous works \cite{unsupervised-clustering-of-web-sessions-to-detect-malicious-and-non-malicious-website-users, wsad-an-unsupervised-web-session-anomalydetection-method} do not employ this statistical test to verify whether the data are effectively clusterable, and this represents a crucial step before proceeding with the analysis. \\[6pt] 
The Hartigan Dip Test \cite{the-dip-test-of-unimodality} evaluates whether a sample originates from a unimodal distribution. The method determines the largest vertical deviation between the empirical cumulative distribution function (ECDF) and the unimodal distribution function that minimizes this deviation. Formally, the dip statistic is defined as
\[
\mathrm{DIP} = \max_{x} \left| F_n(x) - U(x) \right|,
\]
where \(F_n(x)\) denotes the empirical distribution function and \(U(x)\) is the unimodal cumulative distribution function that yields the smallest maximum difference.

\begin{figure}[H]
  \centering
  \includegraphics[width=1\textwidth]{images/dip_test_visualization}
  \caption{Visualization of the Dip Test procedure}
  \label{fig:dip_test_visualization}
\end{figure}
As illustrated in Figure~\ref{fig:dip_test_visualization}, the ECDF exhibits a flat region, which indicates a departure from unimodality. The distribution \(U(x)\) shown in the figure represents only an initial candidate and not the final unimodal approximation. The algorithm iteratively searches for the unimodal cumulative distribution function that is closest to the ECDF. To achieve this, it constructs the Least Concave Majorant (LCM) and the Greatest Convex Minorant (GCM) of the empirical distribution and combines them. The dip statistic corresponds to the maximum vertical distance between the empirical cumulative distribution function and the unimodal cumulative distribution function that minimizes this distance. \\[6pt]
To visualize the outcomes of the Dip Test, several datasets are examined, and some of them are found not to be clusterable. The essential point is that when the data are not clusterable, a preprocessing step becomes necessary. For instance, in the Gaussian quantiles dataset, the data are not clusterable, indicating that some form of preprocessing is necessary.
\begin{figure}[H]
  \centering
  \includegraphics[width=1  \textwidth]{images/dip_test_analysis}
  \caption{Dip Test analysis}
  \label{fig:dip_test_analysis}
\end{figure}
\noindent
However, there are cases in which a dataset is clusterable, although the p-value is greater than 0.005. For example, in the case of the \textit{make\_moons} dataset, the Dip Test yields a p-value above this threshold even though the structure is clearly clusterable. As reported in the paper, the distance-based method identifies clusterable data with a success rate of about 95\% for both simulated and real datasets. What is particularly important, and explicitly noted by the authors, is that applying the Dip Test to the distance distribution results in a Type~I error rate of roughly 1\%. This indicates that it is unlikely for the test to classify a dataset as clusterable when it is not. Therefore, even when the Dip Test returns a p-value greater than 0.005, the dataset may still be clusterable, whereas a p-value close to zero provides stronger evidence in favour of clusterability.
\begin{figure}[H]
  \centering
  \includegraphics[width=1\textwidth]{images/dip_test_analysis_make-moons}
  \caption{Dip Test analysis on the make\_moons dataset}
  \label{fig:dip_test_analysis_make-moons}
\end{figure}

\subsection{Self-Organizing Map} \label{som}

The Self-Organizing Map (SOM), originally proposed by Kohonen~\cite{the-self-organizing-map}, is an unsupervised neural algorithm that performs dimensionality reduction and topology-preserving vector quantization. The model consists of a finite set of neurons arranged on a two-dimensional grid (rectangular or square), although higher-dimensional grids are possible. \\[6pt]
Let the SOM contain \(K\) neurons. Each neuron \(i \in \{1,\dots,K\}\) is associated with a prototype (codebook) vector
\[
\mathbf{m}_i(t) \in \mathbb{R}^n,
\]
where \(n\) is the dimensionality of the input space and \(t\) denotes the training iteration. The set of all prototypes is denoted
\[
\mathcal{M}(t) = \{\mathbf{m}_1(t), \dots, \mathbf{m}_K(t)\}.
\]

\vspace{6pt}
\noindent
Let the dataset consist of \(M\) vectors
\[
\mathbf{x}_s \in \mathbb{R}^n, \qquad s = 1,\dots,M.
\]
Each neuron has a fixed position vector \(\mathbf{r}_i \in \mathbb{R}^2\) on the map grid. These locations are used to define neighborhood relationships, not to be confused with \(\mathbf{m}_i\), which exist in input space.

\subsubsection*{Best Matching Unit (BMU)}
Given an input vector \(\mathbf{x}_s\), its best matching prototype (BMU) is the neuron
\[
c(s) = \arg\min_{i} \|\mathbf{x}_s - \mathbf{m}_i(t)\|.
\]

\subsubsection*{Online (Sequential) Training}
At each iteration \(t\), one sample is presented and the prototypes are updated. A neighborhood kernel \(h_{ci}(t)\) modulates how strongly neuron \(i\) reacts to input belonging to BMU \(c\):
\[
\mathbf{m}_i(t+1)
=
\mathbf{m}_i(t)
+
\alpha(t)\,h_{c(s)i}(t)\,\bigl[\mathbf{x}_s-\mathbf{m}_i(t)\bigr],
\]
where:
- \(\alpha(t) \in (0,1)\) is the learning rate (monotonically decreasing),
- \(h_{c(s)i}(t) \in (0,1]\) is the neighborhood function.
A common choice for the neighborhood function is a Gaussian kernel:
\[
h_{ci}(t) =
\exp\!\left(
-\frac{\|\mathbf{r}_c - \mathbf{r}_i\|^2}{2\sigma^2(t)}
\right),
\]
where \(\sigma(t)\) is the neighborhood radius. Typically,
\[
\sigma(t)=\sigma_0\exp\!\left(-\frac{t}{\tau}\right),
\]
with initial radius \(\sigma_0\) and time constant \(\tau\). \\[6pt]
Kohonen suggests that the total number of online training steps should be at least several hundred times the number of neurons, e.g., \(500K\). A typical learning rate schedule is linear or exponential decay, for example
\[
\alpha(t)=0.9\left(1-\frac{t}{1000}\right).
\]

\subsubsection*{Batch Training}
The batch SOM update~\cite{essential-of-the-self-organizing-map} uses the entire dataset at once. After determining the BMU for every sample, the prototype vectors are updated as weighted averages:
\[
\mathbf{m}_i^{*}
=
\frac{\sum_{s=1}^{M} h_{c(s),i}\,\mathbf{x}_s}
     {\sum_{s=1}^{M} h_{c(s),i}}.
\]
This formulation does not require a learning rate and usually converges faster and more stably than sequential training. \\[6pt]
An equivalent and computationally efficient form groups samples by their BMU. Let \(S_j\) be the set of samples mapped to neuron \(j\), and \(n_j = |S_j|\). Let
\[
\mathbf{x}_{\mu,j}
=
\frac{1}{n_j}
\sum_{\mathbf{x}_s \in S_j}\mathbf{x}_s
\]
be the mean of those samples. The batch update becomes
\[
\mathbf{m}_i^* =
\frac{
\sum_{j=1}^{K} n_j\,h_{ji}\,\mathbf{x}_{\mu,j}
}{
\sum_{j=1}^{K} n_j\,h_{ji}
}.
\]

\subsubsection*{Initialization}
Prototype vectors can be initialized randomly or using the first two principal components (PCA) to accelerate convergence, especially when Euclidean distance is used.

\subsubsection*{Distance Measures}
Kohonen discusses two similarity metrics:
- Euclidean distance (dissimilarity),
- Cosine similarity via normalized dot product.
In high dimensions the difference is often negligible, but with sparse data cosine similarity is computationally advantageous.

\subsubsection*{Neighborhood Width}
The kernel width \(\sigma\) should not decay to zero. Practical guidelines:
- Minimum \(\sigma \approx 0.5\) grid units.
- For large maps, \(\sigma\) may be set to \(0.05\) of the shorter grid dimension.

\subsection*{Quantization and Topology Preservation}

The SOM seeks to minimize the average quantization error between samples and their BMUs, a concept Kohonen refers to as \emph{optimal partitioning}. However, additional indices evaluate preservation of the input topology on the map lattice.

\paragraph{Quantization Error}
The quantization error (QE) for dataset \(\{\mathbf{x}_s\}\) is:
\[
\mathrm{QE}
=
\frac{1}{M}\sum_{s=1}^{M}
\left\|
\mathbf{x}_s - \mathbf{m}_{c(s)}
\right\|.
\]
Increasing \(K\) typically reduces QE but may impair topology preservation~\cite{survey-and-comparison-of-quality-measures-for-self-organizing-maps}.

\paragraph{Topographic Error}
The topographic error (TE)~\cite{survey-and-comparison-of-quality-measures-for-self-organizing-maps} measures whether the first- and second-best matching units of each sample are adjacent:
\[
\mathrm{TE}
=
\frac{1}{M}
\sum_{s=1}^{M}
\mathbb{I}\!\left[
\delta\!\left(c^{(1)}(s),\,c^{(2)}(s)\right) > 1
\right],
\]
where \(\delta(\cdot,\cdot)\) denotes graph distance on the map grid, and \(c^{(1)},c^{(2)}\) are the first and second BMU indices.

\paragraph{Topographic Product}
The topographic product (TP)~\cite{survey-and-comparison-of-quality-measures-for-self-organizing-maps,a-survey-and-implementation-of-performance-metrics-for-self-organized-maps}
quantifies map dimensionality suitability. Let
- \(d(\cdot,\cdot)\) denote input-space distance,
- \(\delta(\cdot,\cdot)\) denote grid distance.
Define for neuron \(j\) the \(k\)-th nearest neighbors:
- \(n_k^\delta(j)\): nearest in grid space,
- \(n_k^d(j)\): nearest in input space.
Define ratios
\[
Q_1(j,k) =
\frac{d(\mathbf{m}_j,\mathbf{m}_{n_k^\delta(j)})}
     {d(\mathbf{m}_j,\mathbf{m}_{n_k^d(j)})},
\qquad
Q_2(j,k) =
\frac{\delta(j,n_{k}^\delta(j))}
     {\delta(j,n_{k}^d(j))}.
\]
Their geometric mean is
\[
P_3(j,k)=
\Biggl[
\prod_{l=1}^{k}
Q_1(j,l)\,Q_2(j,l)
\Biggr]^{\frac{1}{2k}}.
\]
The topographic product is
\[
\mathrm{TP}
=
\frac{1}{K(K-1)}
\sum_{j=1}^{K}
\sum_{k=1}^{K-1}
\log P_3(j,k).
\]
Negative values \((\mathrm{TP}<0)\) indicate insufficient map dimensionality; positive values \((\mathrm{TP}>0)\) indicate excessive dimensionality. This measure is reliable primarily for nearly linear data.

\subsection*{Clustering on SOM Prototypes}

Several works~\cite{clustering-of-the-self-organizing-map,on-the-use-of-self-organizing-map-for-text-clustering-in-engineering-change-process-analysis-a-case-study} cluster data indirectly by clustering SOM prototypes instead of the full dataset. Since \(K \ll M\), this approach offers reduced computational cost and noise smoothing because prototypes represent local averages. \\[6pt]
This method is effective only if the SOM has preserved the data topology; otherwise, clustering the prototypes deviates from clustering the raw data. Map visualization often uses distance-based methods such as the U-matrix, which encodes inter-prototype distances through colors. \\[6pt]
The optimal cluster count can be determined using validity indices such as the Davies-Bouldin Index (DBI), though this should be interpreted as guidance rather than strict ground truth. SOM map size is frequently chosen heuristically as
\[
K \approx 5\sqrt{M}.
\]

\subsection{Internal Validation Indices} \label{internal-validation-indices}
In an unsupervised learning problem, where the true class labels are unknown, only internal validation indices can be used to assess the quality of the clustering. These indices evaluate the clustering structure based on intrinsic properties of the data, such as cohesion (how close the points within a cluster are) and separation (how distinct different clusters are), without relying on any external ground truth labels. \\[6pt]
In \cite{from_a-to-z_review_of_clustering_validation_indices}, the authors provide an extensive review of both classical and recently proposed clustering validation indices, including a summary table of their computational complexity, advantages, and limitations. The newly proposed WB index is the only one that identifies the correct number of clusters in all the datasets tested. Although the way the WB index is applied differs from the approach used in this work, an additional evaluation is carried out to verify whether it also performs well in this context.

\subsubsection{WB Index}
According to \cite{wb-index-a-sum-of-squares-based-index-for-cluster-validity}, this family of indices, which is based on sums of squares, shows promising results in determining the number of clusters. These indices rely on the sum of squares within clusters (SSW), and the sum of squares between clusters (SSB).
\[
\begin{array}{l}
\text{SSW} = \displaystyle \sum_{i=1}^{N} \left\lVert x_i - c_{p_i} \right\rVert^{2}
\qquad\qquad
\text{SSB} = \displaystyle \sum_{i=1}^{M} n_i \left\lVert c_i - \bar{X} \right\rVert^{2}
\end{array}
\]
\[
\begin{aligned}
X &= \{x_1, \ldots, x_N\} && \text{dataset of } N \text{ points} \\[6pt]
\bar{X} &= \frac{1}{N}\sum_{i=1}^N x_i && \text{global mean} \\[6pt]
C &= \{c_1, \ldots, c_M\} && \text{set of } M \text{ cluster centroids} \\[6pt]
c_i &= \text{centroid of the } i\text{-th cluster} \\[6pt]
p_i &= \text{cluster index (label) of point } x_i \\[6pt]
n_i &= \text{number of points in the } i\text{-th cluster}
\end{aligned}
\]
The WB index is calculated as:

\begin{equation}
\label{eq:wb_index}
\mathrm{WB} = M \, \frac{\mathrm{SSW}}{\mathrm{SSB}}
\end{equation}
Unfortunately, no Python implementation of the WB index appears to be available in the literature, therefore the following code provides the implementation.
\begin{lstlisting}
def wb_index(self, data: np.ndarray, labels: np.ndarray) -> float:
    n_clusters = len(np.unique(labels))
    overall_mean = np.mean(data, axis=0)
    
    ssw = 0
    ssb = 0
    for k in np.unique(labels):
        cluster_points = data[labels == k]
        cluster_mean = np.mean(cluster_points, axis=0)
        ssw += np.sum((cluster_points - cluster_mean) ** 2)
        ssb += len(cluster_points) * np.sum((cluster_mean - overall_mean) ** 2)
    
    wb = n_clusters * (ssw / ssb)
    return wb
\end{lstlisting}
The optimal value for this metric is the minimum. However, when the data have more than two dimensions, the metric rarely identifies a clear minimum. Since the dataset used in this work contains 31 features, this metric is not suitable. Moreover, it is designed for data that follow a Gaussian distribution, which is the same limitation already discussed for K-Means.
\begin{figure}[H]
  \centering
  \includegraphics[width=1\textwidth]{images/wb-index}
  \caption{WB Index}
  \label{fig:wb-index}
\end{figure}
\noindent
As shown in the plot, the metric has difficulties determining the exact number of clusters in the \textit{make\_moons} dataset, while it performs well on the \textit{make\_blobs} dataset.

\subsubsection{Silhouette Coefficient}

The Silhouette coefficient \cite{silhouettes_a_graphical_aid_to_the_interpretation_and_validation_of_cluster_analysis} measures the consistency of clustering results by quantifying how similar a data point is to other points within its own cluster (cohesion) compared to points in other clusters (separation). For a data point $i$, it is defined as:

\begin{equation}
s(i) = \frac{b(i) - a(i)}{\max\{a(i), b(i)\}}
\end{equation}

where:
\begin{itemize}
    \item $a(i)$ is the average distance between $i$ and all other points in the same cluster (intra-cluster cohesion).
    \item $b(i)$ is the minimum average distance between $i$ and all points in any other cluster (inter-cluster separation).
\end{itemize}
The Silhouette value ranges from $-1$ to $1$, where values close to $1$ indicate that a sample is well matched to its own cluster and poorly matched to neighboring clusters. The overall Silhouette score is computed as the mean of $s(i)$ across all data points. The computational complexity of the Silhouette index is $O(n^2)$, where $n$ is the number of data points. \\[6pt]
As noted by Rousseeuw, the Silhouette coefficient is most informative when the clusters are compact and well separated, and when their structure is close to spherical.
\begin{figure}[H]
  \centering
  \includegraphics[width=1\textwidth]{images/silhouette}
  \caption{Silhouette}
  \label{fig:silhouette}
\end{figure}
\noindent
This figure illustrates that the Silhouette score struggles to detect the appropriate number of clusters in the \textit{make\_moons} dataset, while it provides a clear indication of the optimal partitioning for the \textit{make\_blobs} dataset.

\subsubsection{Davies--Bouldin Index}

% Rij = (Si + Sj) / Mij
% If Rij is large --> clusters i and j are too similar (they’re close and/or not compact)
% If Rij is small --> they are well separated

The Davies--Bouldin Index (DBI) \cite{a_cluster_separation_measure} is another widely used internal evaluation metric. It quantifies the average similarity between each cluster and the most similar one to it, where the similarity is defined as a function of the ratio between within-cluster scatter and inter-cluster separation. It is defined as:

\begin{equation}
DBI = \frac{1}{k} \sum_{i=1}^{k} \max_{j \neq i} \left( \frac{S_i + S_j}{M_{ij}} \right)
\end{equation}

where:
\begin{itemize}
    \item $k$ is the number of clusters.
    \item $S_i$ is the average distance between each point in cluster $i$ and the centroid of cluster $i$ (intra-cluster scatter).
    \item $M_{ij}$ is the distance between the centroids of clusters $i$ and $j$ (inter-cluster separation).
\end{itemize}
A lower DBI value indicates a better clustering result, as it reflects low intra-cluster dispersion and high inter-cluster separation. Its computational complexity is $O(n)$, making it more efficient than the Silhouette coefficient.
\begin{figure}[H]
  \centering
  \includegraphics[width=\textwidth]{images/dbi}
  \caption{Davies-Bouldin Index (DBI)}
  \label{fig:dbi}
\end{figure}
\noindent
The same reasoning applied to the Silhouette score also applies to the Davies-Bouldin Index, since both metrics evaluate the quality of the clustering based on intra-cluster cohesion and inter-cluster separation, although they do so through different formulations. \\[6pt]
These observations align with the findings of Gagolewski \textit{et al.}~\cite{are_cluster_validity_measures_(in)valid}, who show that several widely used internal validity indices, including the Silhouette and the Davies--Bouldin coefficient, may favor clusterings that do not correspond to expert judgement, particularly when they are used as objective functions to be maximized. 
In their study, Gagolewski \textit{et al.} also introduce more robust alternatives to classical validity measures, for example OWA-based generalized Dunn variants, which are available in the \texttt{genieclust} library~\cite{genieclust_fast_and_robust_hierarchical_clustering}.
\subsubsection{DuNN-OWA}
Let $X=\{x_1,\dots,x_n\}$ and let $C(i)$ denote the cluster label of $x_i$. For each $i$, let $NN_M(i)$ be the set of its $M$ nearest neighbours. The DuNN-OWA index is
\begin{equation}
\mathrm{DuNN}(C)=
\frac{
\mathrm{OWA}_s\!\left(
\{\ \|x_i - x_j\| : C(i)\neq C(j),\ i\in NN_M(j)\ \text{or}\ j\in NN_M(i)\ \}
\right)
}{
\mathrm{OWA}_c\!\left(
\{\ \|x_i - x_j\| : C(i)=C(j),\ i\in NN_M(j)\ \text{or}\ j\in NN_M(i)\ \}
\right)
}.
\end{equation}
Only distances in the $M$-nearest neighbour graph are used: the numerator reflects inter-cluster separation and the denominator reflects intra-cluster compactness. OWA operators may be chosen as $\mathrm{Min}$, $\mathrm{Max}$, or $\mathrm{Mean}$, while smooth variants such as $\mathrm{SMin}$ and $\mathrm{SMax}$ downweight extreme values, reducing the influence of isolated outliers. \\[6pt]
To avoid degenerate ratios, if one of the distance sets is empty, default values can be used (e.g.\ $\mathrm{OWA}_s=0$
or $\mathrm{OWA}_c=+\infty$), since $\mathrm{DuNN}(C)=0$ indicates no inter-cluster separation and
$\mathrm{DuNN}(C)=+\infty$ indicates perfect separation with no internal connectivity. \\[6pt]
This metric shows good performance on the \textit{make\_moons} and \textit{make\_blobs} datasets. \\[6pt]
The optimal clustering corresponds to the highest DuNN-OWA score.
\begin{figure}[H]
  \centering
  \includegraphics[width=\textwidth]{images/dunn_owa}
  \caption{DuNN-OWA index values}
  \label{fig:dunn_owa}
\end{figure}

\section{Labeling}
In the study~\cite{text-clustering-as-classification-with-llms}, the authors propose a technique for performing clustering by relying exclusively on large language models. The method consists of two main stages. \\[6pt]
In the first stage, the objective is to identify potential labels for the dataset. Due to the context window limitations of the models, the dataset is divided into batches, each batch is processed to assign preliminary labels to its samples, and the resulting candidate labels are then aggregated. This aggregation step is necessary because different batches may produce labels with distinct terms but equivalent meanings. \\[6pt]
In the second stage, the approach performs a classification task. Each text sample is assigned to one of the previously determined labels, which enables the clustering process. The authors also evaluate the token cost associated with the method and provide the prompts employed in their experiments. \\[6pt]
This article focuses on text clustering, however, it explores several approaches \cite{beyond-words-a-comparative-analysis-of-llm-embeddings-for-effective-clustering}. The authors investigate how different large language models generate embeddings for clustering tasks. Multiple models are tested and compared with classical embedding methods. Six clustering techniques are evaluated, one of which is K-Means, and the GPT based model achieves the highest performance. Furthermore, when using GPT embeddings, even a simple algorithm such as K-Means performs well. \\[6pt]
Text clustering is not the primary focus of this thesis. However, large language models (LLMs) have evolved at a rapid pace, with increasingly promising benchmark results. In this work, we investigate whether LLMs can effectively handle contextual information, process sessions, and interpret HTTP requests. Their performance in these scenarios will be evaluated in the course of this thesis.


% \section{Session Identification \& Machine Learning Techniques (NON CONTROLLARE QUESTA SEZIONE)}
% In the paper \cite{tan}, published in 2002, the authors studied the navigation patterns of web robots and analyzed that they were quite different from those of human users. They proposed a new session identification algorithm in which, for each raw log entry, four groups of candidate sessions had to be created in this way:
% \begin{enumerate}
%     \item Sessions whose IP address and User-Agent match those in the raw log entry
%     \item Sessions that have the same User-Agent as in the raw log entry but a different IP address
%     \item Sessions that have the same User-Agent and share a common class C address in the raw log entry
%     \item Sessions that have the same IP address but different User-Agent in the raw log entry
% \end{enumerate}
% Then, the \textit{bestCandidate} function chose the most likely session to contain the raw log, starting to scan from the first group through to the fourth.
% As a session interval timeout, they used 30 minutes to determine if a raw log belongs to a given session.
% Once the sessions were defined, the next step was the labeling of the session; for each session, three attributes (access to the \textit{robots.txt}, percentage of HEAD requests, percentage of unassigned referers) were used. In addition, the sessions were labeled according to the User-Agent, and in the case of sessions that contain multiple User-Agents, the labeling system favored a non-robot User-Agent. They used 20 features in the classification task (decision tree algorithm) and discovered that some attributes were highly correlated with web robot sessions. In fact, the results of their experiments showed that web robots could be detected with more than 90\% accuracy after four requests.
% \begin{table}[H]
% \centering
% \begin{tabularx}{\textwidth}{|X|X|X|}
% \hline
% \textbf{Supervised/Unsupervised} & \textbf{Real-time/Non real-time} & \textbf{Labelling/No Labelling} \\[6pt]
% \hline 
% Supervised (Decision trees) & Non real-time & Automatic labelling \\[6pt]
% \hline
% \end{tabularx}
% \end{table}

% According to \cite{probabilistic}, a Bayesian Network was used to classify access log sessions as either crawler or human. This study was one of the first to propose a probabilistic approach to this problem. Requests were aggregated into sessions by IP address and User-Agent, using an adaptive time interval threshold. Six features were used in total. They developed a semi-automatic method to assign labels and ignore sessions that contain fewer than 5 requests. In addition, the authors encountered a problem of class imbalance during the training phase that affects the classifiers, which tend to be biased toward the majority class. They conducted five experiments using random under-sampling of human sessions and random over-sampling of crawler sessions. The strategy that led to the best result was the oversampling (duplication) of 50\% of the crawler sessions.
%  \begin{table}[H]
% \centering
% \begin{tabularx}{\textwidth}{|X|X|X|}
% \hline
% \textbf{Supervised/Unsupervised} & \textbf{Real-time/Non real-time} & \textbf{Labelling/No Labelling} \\[6pt]
% \hline
% Supervised (Bayesian Network) & Non real-time & Semi-automatic labelling, verified by an expert \\[6pt]
% \hline
% \end{tabularx}
% \end{table}

% This work \cite{real-time-crawler-detection} used the offline detection system of \cite{probabilistic} to perform statistical analyses on the features, which are most suitable for identifying crawlers, and to assign labels to a dataset.
% The most discriminative features were the percentage of image requests, percentage of page requests, percentage of 4xx response codes, session time-out threshold, and maximum click rate. The infrastructure they deployed, for achieving real-time detection, consisted of a \textit{Request Reader} that received HTTP requests and inserted them into an \textit{Incoming Request Queue}, an \textit{Incoming Request Hashtable} where the requests were aggregated by IP address, a \textit{Request Cleaner} that deleted all non-active requests in the hash table, and a \textit{Request Processor} that was responsible for the classification.
% Then, the detection process followed these steps: If the IP address was not found in  a list containing known robots, the sessions were analyzed using the decision tree algorithm. The best results obtained showed that the minimum number of requests was 15, and they demonstrated the feasibility of real-time crawler detection.
%  \begin{table}[H]
% \centering
% \begin{tabularx}{\textwidth}{|X|X|X|}
% \hline
% \textbf{Supervised/Unsupervised} & \textbf{Real-time/Non real-time} & \textbf{Labelling/No Labelling} \\[6pt]
% \hline
% Supervised (Decision trees) & Real-time & Labelling\\[6pt]
% \hline
% \end{tabularx}
% \end{table}

% As described in \cite{unsupervised-clustering-of-web-sessions-to-detect-malicious-and-non-malicious-website-users}, the authors used two different unsupervised neural networks, Self Organizing Map (SOM) and Modified Adaptive Resonance Theory 2 (Modified ART2). Sessions were grouped by IP address and User-Agent pairs in a 30-minute interval. They selected nine features, seven of which were in common with the previous work\cite{tan}. The eighth was the standard deviation of the requested page's depth, which, compared to the depth attribute of the previous research\cite{tan}, was slightly different. In fact, in \cite{tan} the authors created a graph of all the HTML page requests in a session, and the depth was the maximum depth of the tree(s) within the graph. The ninth attribute was the percentage of consecutive sequential HTTP requests to pages belonging to the same web directory, which was different from the width attribute of the previous work \cite{tan}.
% In this work, data set labeling as also used to facilitate understanding and validation of the results obtained by the clustering process. SOM results showed a pretty good separation between human sessions and crawler sessions (both well-behaved and malicious crawlers). ART2 generated six clusters,
%  and the results showed that 96\% of the human sessions fell into cluster 1, suggesting a small variance in this cluster. Furthermore, 95\% of unknown sessions also fell into cluster 1 (confirming the hypothesis made by the authors, in which they claim that the unknown sessions were human sessions), while malicious crawler sessions were spread across all six clusters formed (highest variability), and 8\% of these sessions fell into cluster 1, meaning that they behaved as human sessions.
% \begin{table}[H]
% \centering
% \begin{tabularx}{\textwidth}{|X|X|X|}
% \hline
% \textbf{Supervised/Unsupervised} & \textbf{Real-time/Non real-time} & \textbf{Labelling/No Labelling} \\[6pt]
% \hline 
% Unsupervised (SOM \& ART2) & Non real-time & Automatic labelling to better interpret the results of SOM and ART2 \\[6pt]
% \hline
% \end{tabularx}
% \end{table}

%  In a more recent work \cite{wsad-an-unsupervised-web-session-anomalydetection-method}, the researchers detected malicious crawlers as well as attacks such as brute-force password cracking. Sessions were identified by only IP addresses in a 10-minute interval, and they selected 10 features for anomaly detection in a session, four of which ("proportion of abnormal User-Agent", "access amount" that are total requests with static page access filtered out, "access frequency" that is the number of requests per minute, "number of accesses to sensitive files") were different from previous works \cite{tan}\cite{unsupervised-clustering-of-web-sessions-to-detect-malicious-and-non-malicious-website-users}. They used DBSCAN algorithm (Euclidean distance as a metric to calculate the similarity between samples) to find anomalies in the web sessions. This algorithm needed two parameters to set, MinPts and eps, they set MinPts equal to 11 (10 features + 1), while the value of eps was not present in their paper. The results showed that the rate of missing true attacks was reduced by 64.3\%. They claimed that WSAD could detect attacks, such as directory traversal attacks, that were not recognized by the web application firewall.
%  \begin{table}[H]
% \centering
% \begin{tabularx}{\textwidth}{|X|X|X|}
% \hline
% \textbf{Supervised/Unsupervised} & \textbf{Real-time/Non real-time} & \textbf{Labelling/No Labelling} \\[6pt]
% \hline 
% Unsupervised (DBSCAN) & Non real-time & No labelling \\[6pt]
% \hline
% \end{tabularx}
% \end{table}


% % \textbf{WSAD (An Unsupervised Web Session Anomaly Detection Model)}\cite{wsad} can detect malicious crawlers but also attacks such as brute force password cracking attack.
% % The researchers comes from the necessity to detect unknown anomalies without using regular expression based matching because these methods are easily bypassable by using techniques like trans-coding. However it is not necessarily true, it depends on how regular expression rules are written and for instance the trans-coding is not even possible (usually not common characters are blocked by the Web Application Firewall). Sessions are identified by using only IP addresses in a 10 minutes time interval. However this approach raises problems such as identify sessions if clients are behind a NAT because they share the same public IP address, so at the end there is a single session with multiple clients. A solution could be leverage the pair IP address and User-Agent. Likely two users behind the same NAT have different User-Agents. In this case, however, an attacker can change the User-Agent at each request generating always different sessions.
% % They select 10 number features of the session for anomaly detection. The feature they called "Browser automatically access request of ratio" is a ratio of the total static resources retrieved (css, js, png etc.) divided by the total number of requests. It could lead to inconsistencies due to browser caching.
% % A clustering technique is adopted, specifically DBSCAN algorithm (euclidean distance as metric to calculate the similarity between samples) to find anomalies in web sessions. The main two reasons for which authors leveraged DBSCAN are:
% % \begin{itemize}
% %     \item it does not need to setup the number of clusters
% %     \item it can build clusters of various shapes and it can find anomalies
% % \end{itemize}
% % This clustering algorithm needs two parameters to set up, MinPts (neighborhood density threshold) and eps (size of the neighborhood radius). They set MinPts equal to 11 (10 features + 1) while the value of eps is not cited in the paper.
% % Finally they state that WSAD can detect directory traversal, sensitive file access, mixed scan and other attacks and in general the rate of missing of true attacks is reduced by 64,3\%. The authors affirm that directory traversal attacks as well as sensitve file access have not been recognized by the rules of the Web Application Firewall (WAF). However these attacks are generally blocked by principal WAF. In addition the researchers do not cite what WAF test during their analysis.

% % \textbf{Unsupervised Clustering of Web Sessions to Detect Malicious and
% % Non-malicious Website Users}\cite{som-art2} leverages two different unsupervised neural network: Self Organizing Map (SOM) and Modified Adaptive Resonance Theory 2 (Modified ART2). Sessions are grouped by the pair of IP address and User-Agent in 30 minutes interval. The authors select 9 features which some of them are common with the previously cited work except for these new ones:
% % \begin{itemize}
% %     \item Click rate (numerical attribute)
% %     \item Percentage of PDF/PS file requests (numerical attribute)
% %     \item Robots.txt file request (nominal attribute) indicating if \textit{robots.txt} has been requested in the session interval
% %     \item Standard deviation of requested page's depth (numerical attribute)
% %     \item Percentage of consecutive sequential HTTP requests (numerical attribute) belonging to the same web directory
% % \end{itemize}
% % Click rate attribute needs to implement a sort of telemetry in the web pages that collects the number of clicks, but it can be very useful to distinguish humans from basic malicious bad crawlers. Percentage of PDF/PS file requests is specific to their case.
% % Consequently sessions are labeled based on the value of the features. This is done to facilitate the understanding and the validation of the results that are obtained by the clustering process.
% % Sessions with less than 5 requests in total are ignored.
% % They choose a SOM comprising 100 neurons in 10-by-10 hexagonal arrangement. The map was trained with 200 epochs. The ART2 algorithm was executed with $\rho_{max}$ = 1.4, $\Delta \rho$ = 0.1 and $n_{max}$ = 6. All input vectors were normalized prior to being fed to SOM and Modified ART2.
% % SOM results show a pretty good separation between human sessions and crawler sessions (bot well-behaved crawler and malicious crawlers). There are sessions labeled as human, but behaves like malicious crawlers that identify themselves as human (for instance changing the User-Agent field). Indeed those sessions active neurons in the region of the malicious crawlers.
% % On the other hand ART2 results show that 96\% of the human sessions fall into cluster 1, suggesting small variance of this cluster group. 95\% of unknown sessions also fall into cluster 1 (confirming the hyptohesis that unknown sessions are human sessions). While malicious crawler sessions are spread over all 6 formed clusters (greatest variability) and 8\% of these sessions fall into cluster 1, meaning that behaves like human sessions.

% In this master's thesis \cite{botsbfuod}, the author used 62 features, most of which are biometric data, collected in an embedded script on a website. Unlike previous studies \cite{tan}\cite{som-art2}\cite{wsad}, for clients who were able to accept cookies, a Google Analytics ID was assigned to them; otherwise, requests that had the same IP address and User-Agent were aggregated. In both cases, the session interval is 30 minutes. The Google Analytics ID was used to track users across proxies; in fact, it is a unique identifier of the user who visited the website. The author conducted two experiments, in both of which the Isolation Forest model had the best classification performance. It was also the fastest to train and the one that required the least amount of data compared to the others (Autoencoders, Local Outlier Factor). All the source code for both the collector and the models is included in the appendix.
%  \begin{table}[H]
% \centering
% \begin{tabularx}{\textwidth}{|X|X|X|}
% \hline
% \textbf{Supervised/Unsupervised} & \textbf{Real-time/Non real-time} & \textbf{Labelling/No Labelling} \\[6pt]
% \hline
% Unsupervised (Isolation Forest \& Local Outlier Factor \& Autoencoder) & Non real-time & Labelling\\[6pt]
% \hline
% \end{tabularx}
% \end{table}

% Except for the most recent work \cite{botsbfuod}, in which the author employed a stronger method for session aggregation (using the Google Analytics ID), all other studies relied on either the IP address and User-Agent, or only the IP address. These types of aggregation methods have several weaknesses. For example, if two users are behind the same NAT, they will appear to have the same IP address. As a result, if aggregation is based solely on IP address, the two users will be grouped into the same session. Moreover, if a user changes their IP address with each request, this results in each request being treated as a separate session. The same issue arises when aggregation is based on both IP address and User-Agent. Although it is less likely for two users to share both the same IP address and User-Agent, it can still happen. Furthermore, changing the IP address or the User-Agent for each request causes the server to treat them as belonging to different sessions. For this reason, the next section reviews more robust methods of session identification.

% \section{Session Identification}
% In the present study \cite{fp-crawlers}, the authors examined approaches to detect crawlers using browser fingerprinting. This technique does not require user interaction and requires only a single request to detect crawlers. They specifically focused on identifying browser inconsistencies through various JavaScript attributes and User-Agents. The authors created seven crawlers with modified attributes in an attempt to bypass crawler detection on the Alexa top 10k websites. They discovered that the fingerprints used by these websites heavily rely on the \texttt{navigator} attribute from the \texttt{webdriver} object, meaning that if the fingerprinting method used by a website is known, it can be bypassed. Moreover, as they noted, this technique is primarily used to block crawlers that do not rely on standard browsers, since standard browsers do not exhibit such inconsistencies.
% Following the work of \cite{favicon}, the authors found a way to track users by leveraging favicons to create a persistent identifier. In fact, the favicon cache (F-cache) is a dedicated cache that is not part of the browser's HTTP cache; for this reason, it is not affected by deleting the browser's cache, history, or data. The generation of the user ID is performed by redirecting users through a series of subdomains that serve different favicons, thereby storing information in the F-cache. Storing an N-bit identifier allows tracking of $2^N$ users, and N redirections are needed. At the time of the paper, Chrome, Safari, Edge, and Brave suffered from this problem. In Firefox, the authors found a bug whereby it never uses the cache to fetch entries, so it re-fetches favicons even when they are already present. This technique can also track users even if they are using a Virtual Private Network (VPN) or browsing in incognito mode.

