Session2vec: Session Modeling with Multi-Instance Learning for Accurate Malicious Web Robot Detection

This study addresses the side effect of the rapid development of the Internet, positioning botnets within digital ecosystems as a very serious potential threat to the Internet users. Malicious web robot might facilitate Web/data scraping, DDoS attacks, and data theft yielding serious cybersecurity threats. Modern botnets are advanced and have unique browser fingerprints, making their detection a real challenge. Traditional feature extraction methods heavily depend on expert knowledge. They also struggle with dimensional inconsistency when processing sessions of varying lengths, failing to counter evolving camouflage attacks. To approach such challenges, we propose Session2vec, a session representation framework based on multi-instance learning (MIL), which pioneers the MIL approach for Web session modeling. In this approach, we treat each request as an instance and the entire session as an instance collection, and then we use the FastText model to convert each URL request into a vector representation. Then, we utilize two innovative multi-instance aggregation methods: SARD (Session-level Aggregated Residual Descriptors) and SFAR (Session-level Fisher Aggregated Representation) to aggregate variable-length sessions into fixed-dimensional vectors capturing spatiotemporal features and distributional information within sessions. Simulation results of the proposed SARD and SFAR methods on public datasets show accuracy improvement of 5.2% and 16.3% on average, respectively, compared to state-of-the-art baselines. They also enhance F1 scores by 8.5% and 19.7%, respectively.