Log Analysis Apparatus Automatic Re-learning for Web Server Security

The system automatically detects when re-learning is needed by monitoring parameter similarity thresholds and autonomously initiates re-learning processes without requiring manual operator intervention. The log analysis apparatus self-manages the adaptation to system specification changes, eliminating the need for operators to manually re-train the system while maintaining high detection accuracy.

The system continuously monitors the similarity between current access log parameters and learned profile parameters. When similarity falls below a threshold, the system automatically triggers re-learning. This feedback mechanism ensures the system adapts to system specification changes while maintaining high detection accuracy by re-training only when necessary, rather than relying on manual intervention that may be delayed or inconsistent.

The automatic re-learning system is divided into distinct functional modules: a learning unit that extracts and profiles parameters from access logs, an analyzing unit that compares current parameters against profiles and determines attack likelihood, and a re-learning requirement determining unit that monitors similarity thresholds and triggers re-learning when needed. This segmentation manages system complexity by organizing functions into independent, well-defined components that can operate autonomously.

The system performs parameter similarity monitoring and comparison operations periodically based on incoming access logs rather than continuously at fixed intervals. The re-learning process is triggered only when the similarity threshold is breached, making the computational effort periodic and event-driven. This approach maintains detection accuracy by continuously analyzing parameters while conserving computational resources by executing intensive re-learning operations only when necessary.