HTTP request clustering refers to the process of grouping user sessions, defined as sequences of requests performed by a user within a specific time window, into clusters based on behavioral similarities. Since clustering is an unsupervised machine learning technique, it can reveal hidden patterns in user behavior. As a result, it becomes possible to gain insights into common usage scenarios, such as identifying navigation paths, spotting unusual behaviors, or detecting potential anomalies in user interactions. \\[6pt] 
Sicuranext, the company at which this thesis is being conducted, currently uses a Web Application Firewall (WAF) system based on predefined rule matching. However, this approach is limited to analyzing individual requests and responses, without considering the overall session-level traffic. This motivates the use of session-based traffic analysis and unsupervised machine learning techniques to discover behavioral patterns that go beyond manually defined rules. The goal of this work is to investigate whether web sessions can be clustered and automatically labeled to identify their type or intent, with a focus on security-related categories such as attacks and anomalies, using only information available from server-side HTTP logs (e.g., request headers and aggregated features). Although the main interest is in detecting malicious or abnormal behavior, the resulting labels may also capture benign activities. \\[6pt] 
After this step is completed and a label is assigned, supervised learning models or neural networks can be used to train a system able to predict session types in real time. This makes the identification of session intent faster and more accurate, which is especially important for detecting and blocking potentially malicious sessions. The proposed methodology also reduces the time needed to manually analyze and classify sessions. \\[6pt]
The supervised learning part of this approach could be useful for Sicuranext, as it allows the automation of session classification and improves overall system security. However, before reaching this phase, it is essential to ensure that the labels are both available and correct; otherwise, the model may learn wrong patterns and produce unreliable predictions. It should be noted that the development and implementation of the supervised learning model fall outside the scope of this thesis, which focuses mainly on data preparation and labeling. \\[6pt] 
In this article~\cite{impact-of-machine-learning-on-intrusion-detection-systems-for-the-protection-of-critical-infrastructure}, the authors analyzed supervised and unsupervised machine learning algorithms applied to intrusion detection systems, outlining their advantages and drawbacks. Although the domain is different from the topic of this thesis, supervised learning has shown promising results. Their analysis also helps identify when each algorithm is most suitable. For example, the Decision Tree algorithm is both fast and interpretable, which is important in cybersecurity: threats must be blocked quickly, and it is necessary to understand why a specific alert is raised. \\[6pt] 
The Decision Tree algorithm is also suitable for detecting attacks with a WAF~\cite{web-application-firewall-based-on-machine-learning-models}. Although this is not the main focus of this thesis, WAF systems must operate very quickly to detect attacks in real time, and the authors reported good results in this regard. They chose traditional machine learning algorithms instead of deep learning models to improve computational cost. Deep learning automatically extracts features from high-dimensional traffic data, while traditional machine learning requires manual feature selection. The authors also noted that they tested only a small subset of the OWASP Top~10 vulnerabilities and that machine learning algorithms can be exposed to new attack types, such as adversarial inputs designed to evade detection. \\[6pt] 
In this work~\cite{the-threat-of-adversarial-attacks-against-machine-learning-in-network-security-a-survey}, the authors describe adversarial attacks and present techniques designed to defend against them. This aspect represents a possible improvement for this work; when the supervised learning model is trained, these attacks should be considered. \\[6pt] 
Deploying a machine learning model in a production environment is more complex than it may appear. In this paper~\cite{machine-learning-models-in-web-applications-a-comprehensive-review}, the authors highlight practical challenges and review the strengths and limitations of two popular backend frameworks, Node.js and Python. Moreover, deploying a machine learning algorithm can be expensive in terms of infrastructure, which is an important factor to evaluate before moving forward. \\[6pt]
However, this thesis may also serve as a retrospective analysis tool, removing the need to deploy a real-time detection system. Instead, it can be used to evaluate past requests or analyze network traffic to define new static rules for blocking emerging malicious activity. There is also the issue of model retraining, since changes in the volume or distribution of traffic may lead to incorrect session classification. \\[6pt]
The implementation is developed in Python, selected for its wide ecosystem of data analysis and machine learning libraries, which supports rapid experimentation with clustering algorithms. The dataset is built by sending queries to Elasticsearch to retrieve aggregated data, where aggregation is handled directly by Elasticsearch. Afterward, an exploratory data analysis is performed to study feature correlations. Different configurations are tested, including one using all features and another excluding highly correlated ones. \\[6pt] 
To assess whether the dataset is effectively clusterable, a statistical unimodality test known as the Dip Test is applied. However, since this method operates on one-dimensional data, two alternative strategies are considered: (i) reducing dimensionality with Principal Component Analysis (PCA) and performing the test on the first principal component, or (ii) computing pairwise distances and applying the test to these values. \\[6pt]
If the data prove to be clusterable, the standard K-Means algorithm is applied. A dedicated section also discusses how internal clustering metrics may diverge from expert intuition, showing the limitations of purely quantitative evaluation methods. \\[6pt]
Then, to assign labels to the clusters, an LLM is used, mainly because manually assigning labels is very time-consuming. Large language models have recently shown an ability to capture semantic context; therefore, the suitability of an LLM for this task is examined. \\[6pt]
The thesis is organized as follows: Chapter~\ref{related-work} reviews the relevant literature on session identification, feature extraction, exploratory feature analysis, the selection of suitable clustering methods, internal evaluation metrics, and labeling approaches. Chapter~\ref{infrastructure} presents the core components of Sicuranext's infrastructure and describes the system requirements and semantics. Chapter~\ref{implementation-approach} details the practical implementation of the approach, including the creation of the dataset, the analysis of feature correlations, the application of the Dip Test, the clustering experiments, and the labeling process. Finally, Chapter~\ref{conclusion} discusses the results, followed by closing remarks and directions for future work.
