Detecting anomalous Web server usage through mining access logs
Toni Gržinić, Tonimir Kišasondi, Josip Šaban · 2013
Most operating systems services gen- erate log files that can be used for debugging and supervision. One important function of log files is logging security related or debug information, for example logging unsuccessful authentication or error logging. This paper shows how to implement an anomaly detection process of web server's unexpected events using the the Apache web server's logs and applying supervised machine learning algorithms to extracted features. Also, we compare the classification performance of several algorithms that can be easily implemented in real-world scenarios.