Detection of security incidents in a context of unwelcome or dangerous activity of web robots

Abstract

This work presents several scenarios used to identify security incidents based on the analysis of web server log files. The main goal of this work is to identify security events triggered by web robots which can be considered as dangerous or unwelcome. Analysis of all security incidents was based on archived web server log files which were collected from 03.03.2014 to 31.01.2015 and came from the real and fully functional environment, available at www.darmowe-obrazki.pl. All data were obtained automatically on a daily basis and analyzed using Advanced Web Statistics software.