Mining Web session characteristic for boundary defense based on Hidden Markov model

Different from most existing studies on Web session identification, a novel dynamic realtime user session processes description method is presented in this paper. The proposed scheme doesn´t rely on presupposed threshold or client/serverside data which are widely used in traditional session detection approaches. A new parameter is defined based on inter-arrival time of HTTP requests. A nonlinear algorithm is introduced for quantization. Nonparametric hidden semi-Markov model is applied to distinguish the user session processes. A probability function is derived for predicting user session processes. Experiments based on real HTTP traces of large-scale Web proxies are implemented to valid the proposal.