Exploiting Clustering Techniques for Web User-session Inference

We focus on the definition and identification of “Web user-sessions”, an aggregation of several TCP connections generated by the same source host on the basis of TCP connection opening time. The identification of a user session is non trivial; traditional approaches rely on threshold based mechanisms, which are very sensitive to the value assumed for the threshold, which may be difficult to correctly set. By applying clustering techniques, we define a novel methodology to identify Web user-sessions without requiring an a priori definition of threshold values. We discuss pros and cons of this approach, and we define a methodology to be applied to real traffic traces. The proposed methodology is evaluated on artificially generated traces to show its benefits against traditional threshold based approaches. We then analyze the characteristics of user sessions extracted from real traces, studying the statistical properties of the identified sessions.