TraceLog: Session-Based Anomaly Detection for Web Server Access Logs With URL Sequence Rarity and Evidence-Guided Language-Model Interpretation

Abstract

Web server access logs record user behavior as sequences of HTTP requests, but request-level detection may not capture attack flows distributed across multiple requests. This study proposes TraceLog, a session-level anomaly detection framework that groups HTTP requests using an IP–User-Agent client key and a 30-min inactivity timeout and represents each session using 29 session-level features and one URL sequence rarity feature. URL rarity is modeled separately using a first-order Markov model, LogBERT-based masked language modeling, and self-supervised 1D-CNN next-URL prediction, with each resulting representation evaluated in a common Isolation Forest-based pipeline. Model development uses refined normal training data only, and the primary operating threshold is defined as the 99th percentile (P99) of a separate Normal Calibration score distribution without using attack labels. On 49,686 held-out normal sessions and 450 held-out LLM-generated attack sessions, the CNN-based pipeline achieved a Recall of 0.8489, an FPR of 0.0098, an AUC-ROC of 0.9960, and an average precision of 0.7415 at P99. Feature ablation showed that the incremental contribution of URL sequence rarity was modest and dataset-dependent. External validation on an independent operational web server dataset further demonstrated substantial cross-service distribution shift: service-specific rebuilding of the CNN pipeline achieved a held-out FPR of 0.0110 and a Recall of 0.3526 at the primary P99 operating point. For the 869 CNN P99 Alerts, an optional external LLM generated interpretations from locally sanitized evidence without modifying detection decisions; conditional attack-type classification accuracy among the 382 detected attack Alerts was 91.10%. A two-rater evaluation of 100 explanations yielded faithfulness rates of 90% and 67%, with unsupported-statement rates of 0.97% and 3.21%, respectively. These results support TraceLog as an auxiliary session-prioritization and interpretation framework while highlighting limitations in cross-service generalization and LLM-based explanation.