{"id":"https://openalex.org/W7166686718","doi":"https://doi.org/10.7148/2026-0694","title":"Using llms to generate auditable pipeline specifications for risk-tier assignment from http server logs","display_name":"Using llms to generate auditable pipeline specifications for risk-tier assignment from http server logs","publication_year":2026,"publication_date":"2026-06-23","ids":{"openalex":"https://openalex.org/W7166686718","doi":"https://doi.org/10.7148/2026-0694"},"language":null,"primary_location":{"id":"doi:10.7148/2026-0694","is_oa":true,"landing_page_url":"https://doi.org/10.7148/2026-0694","pdf_url":"https://doi.org/10.7148/2026-0694","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.7148/2026-0694","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5053438968","display_name":"Gra\u017cyna Suchacka","orcid":"https://orcid.org/0000-0001-7456-1204"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Grazyna Suchacka","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079242255","display_name":"Grzegorz Chodak","orcid":"https://orcid.org/0000-0002-9604-482X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Grzegorz Chodak","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5089443490","display_name":"Jacek Iwa\u0144ski","orcid":"https://orcid.org/0000-0001-7861-0018"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jacek Iwanski","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"694","last_page":"703"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.32190001010894775,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.32190001010894775,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.21400000154972076,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.11640000343322754,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/json","display_name":"JSON","score":0.5478000044822693},{"id":"https://openalex.org/keywords/specification","display_name":"Specification","score":0.4959000051021576},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.4778999984264374},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.46320000290870667},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.4036000072956085},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.38839998841285706},{"id":"https://openalex.org/keywords/relational-database","display_name":"Relational database","score":0.35040000081062317},{"id":"https://openalex.org/keywords/web-server","display_name":"Web server","score":0.33959999680519104},{"id":"https://openalex.org/keywords/specification-language","display_name":"Specification language","score":0.3314000070095062}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7419999837875366},{"id":"https://openalex.org/C2780416260","wikidata":"https://www.wikidata.org/wiki/Q2063","display_name":"JSON","level":2,"score":0.5478000044822693},{"id":"https://openalex.org/C117222624","wikidata":"https://www.wikidata.org/wiki/Q7575010","display_name":"Specification","level":2,"score":0.4959000051021576},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.4778999984264374},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.46320000290870667},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.42080000042915344},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.4036000072956085},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.38839998841285706},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.38089999556541443},{"id":"https://openalex.org/C5655090","wikidata":"https://www.wikidata.org/wiki/Q192588","display_name":"Relational database","level":2,"score":0.35040000081062317},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.33959999680519104},{"id":"https://openalex.org/C201677973","wikidata":"https://www.wikidata.org/wiki/Q1209840","display_name":"Specification language","level":2,"score":0.3314000070095062},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.32010000944137573},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.28760001063346863},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.287200003862381},{"id":"https://openalex.org/C116253237","wikidata":"https://www.wikidata.org/wiki/Q1437424","display_name":"Formal specification","level":2,"score":0.2863999903202057},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.28360000252723694},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.27469998598098755},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2720000147819519},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.26899999380111694},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.26739999651908875},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.2667999863624573},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.26100000739097595},{"id":"https://openalex.org/C175309249","wikidata":"https://www.wikidata.org/wiki/Q725864","display_name":"Pipeline transport","level":2,"score":0.26080000400543213},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.2587999999523163},{"id":"https://openalex.org/C153180980","wikidata":"https://www.wikidata.org/wiki/Q19776675","display_name":"Commit","level":2,"score":0.2587999999523163},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.25780001282691956},{"id":"https://openalex.org/C80958533","wikidata":"https://www.wikidata.org/wiki/Q1047174","display_name":"Audit trail","level":3,"score":0.2508000135421753}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.7148/2026-0694","is_oa":true,"landing_page_url":"https://doi.org/10.7148/2026-0694","pdf_url":"https://doi.org/10.7148/2026-0694","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.7148/2026-0694","is_oa":true,"landing_page_url":"https://doi.org/10.7148/2026-0694","pdf_url":"https://doi.org/10.7148/2026-0694","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7166686718.pdf","grobid_xml":"https://content.openalex.org/works/W7166686718.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Bot":[0],"traffic":[1,51],"in":[2,163],"e-commerce":[3,122],"HTTP":[4,79],"data":[5],"incurs":[6],"costs":[7],"and":[8,36,95,100,113,137],"is":[9,106],"increasingly":[10],"difficult":[11],"to":[12,48,170],"identify,":[13],"while":[14,200],"reliable":[15],"\u201cbot":[16],"vs.":[17],"human\u201d":[18],"ground-truth":[19,127],"labels":[20],"are":[21,59,168],"rarely":[22],"available":[23],"for":[24,66],"the":[25,41],"most":[26],"problematic":[27],"agents.":[28],"In":[29],"this":[30],"paper,":[31],"we":[32,70],"propose":[33],"a":[34,72,85,90,110,117,190],"reproducible":[35],"auditable":[37],"evaluation":[38],"setting":[39],"with":[40],"use":[42],"of":[43,89,120],"large":[44],"language":[45],"models":[46,153,194],"(LLMs)":[47],"generate":[49],"web":[50],"categorization":[52],"pipeline":[53,92,112],"specifications":[54,143],"from":[55],"log":[56,80],"data.":[57],"LLMs":[58],"not":[60],"used":[61],"as":[62,189,207],"black-box":[63],"detectors,":[64],"or":[65],"code":[67],"generation.":[68],"Instead,":[69],"formulate":[71],"controlled":[73],"specification":[74,88,105,187],"task:":[75],"given":[76],"an":[77],"anonymized":[78],"sample,":[81],"each":[82],"LLM":[83],"produces":[84],"structured":[86],"JSON":[87],"bot-categorization":[91],"(token":[93],"taxonomy":[94],"precedence,":[96],"normalization,":[97],"feature":[98],"definitions,":[99],"deterministic":[101,111],"silver-label":[102],"rules).":[103],"The":[104],"then":[107],"compiled":[108],"into":[109],"evaluated":[114],"automatically":[115],"on":[116,197,202],"full":[118],"day":[119],"production":[121],"server":[123],"logs":[124],"without":[125],"using":[126,144,181],"labels.":[128],"We":[129],"assess":[130],"risk-oriented":[131],"clustering":[132],"robustness":[133],"via":[134],"bootstrap":[135],"stability":[136],"compare":[138],"induced":[139],"behavioral":[140,198],"structure":[141,199],"across":[142],"Adjusted":[145],"Mutual":[146],"Information":[147],"(AMI).":[148],"Results":[149],"show":[150],"that":[151],"several":[152],"recover":[154],"highly":[155],"similar":[156],"session-clustering":[157],"structure,":[158],"although":[159],"they":[160],"differ":[161],"substantially":[162],"risk-tier":[164],"policies":[165],"when":[166],"clusters":[167],"mapped":[169],"operational":[171],"tiers":[172],"(HIGH":[173],"risk,":[174,176,178],"MEDIUM":[175],"LOW":[177],"OTHER,":[179],"NOISE)":[180],"deterministic,":[182],"interpretable":[183],"rules.":[184],"This":[185],"reveals":[186],"bias":[188],"practical":[191],"deployment":[192],"concern:":[193],"may":[195],"agree":[196],"disagreeing":[201],"what":[203],"should":[204],"be":[205],"treated":[206],"high":[208],"risk.":[209]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-07-01T00:00:00"}