Web server access trend analysis based on the Poisson distribution

To determine the amount of computational resources such as CPU power, memory, and network bandwidth to be assigned to web servers, it is useful to capture daily access data. These can be captured in advance from access logs. Moreover, to determine thresholds for detecting attacks such as distributed denial of service, where the rate of access varies significantly, it is important to know usual access trends for a given server. In this paper, we propose a method for capturing patterns of access to web servers by analyzing access logs. Instead of directly analyzing the periodicity of access using Fourier transforms, we analyze access trends based on an abstract model where only changes to access frequency are captured. This abstract model, constructed by determining whether access frequency follows a Poisson distribution, is simpler than the original access log and is specialized as it only contains information about access frequency changes. Therefore, it is easy to capture access trends based on this model. We analyzed two access logs using our method, the logs of the web servers at Saskatchewan University and those of the National Aeronautics and Space Administration. We confirmed that our method can be used to capture several characteristic access trends.