Open access
2026
TraceLog: Session-Based Anomaly Detection for Web Server Access Logs With URL Sequence Rarity and Evidence-Guided Language-Model Interpretation
Web server access logs record user behavior as sequences of HTTP requests, but request-level detection may not capture attack flows distributed across multiple requests. This study proposes TraceLog, a session-level anomaly detection framework that groups HTTP requests using an IP–User-Agent client key and a 30-min ina...
Seyeon Jang, Jinho Park, Nayoung Kim et al.
· IEEE Access · 0 citations