[Introduction to Incident Handling and Response] Johnson an incident handler is working on a recent web application attack faced by the organization…

The process described involves taking raw outbound network traffic data and organizing it into "time-ordered domain sequences" based on "user activities within a certain time period." This is the definition of user-specific sessionization. Sessionization is a critical data preprocessing step that reconstructs a user's sequence of actions (in this case, visiting domains) from discrete log entries. This creates structured sessions that can then be analyzed for patterns, such as the sequence of events characteristic of a watering hole attack where a user visits a legitimate site and is then redirected to a malicious one.

A. Filtering invalid host names: This is a data cleaning step to remove malformed or non-resolvable domain entries, not to create time-ordered user activity sequences.
B. Identifying unpopular domains: This is a frequency analysis technique applied after preprocessing to find anomalies, not the process of creating the user sessions themselves.
C. Host name normalization: This step standardizes domain names (e.g., www.example.com to example.com) for consistent analysis but does not involve sequencing user activities over time.

1. Lee

S.

Kim

J.

Lee

S.

& Kim

J. (2017). WOHD: A Watering Hole Attack Detection System Based on User Browsing Behavior. In Applied Sciences

7(9)

868. This paper describes a system for detecting watering hole attacks and explicitly states: "The first step is to reconstruct user sessions from the raw web proxy logs. A session is a sequence of web requests made by a user within a certain time period." (Section 3.1

Paragraph 1). DOI: https://doi.org/10.3390/app7090868

2. Kambourakis

G.

& Tsochou

A. (2020). A Comprehensive Technical Review on the Watering Hole Attack. In IEEE Access

8

169636-169656. The review discusses detection methods based on analyzing web traffic and user behavior

which inherently requires preprocessing steps like sessionization to group related user activities for sequential analysis. (Section IV. B. Detection Methods). DOI: https://doi.org/10.1109/ACCESS.2020.3023802

3. Zarras

A.

& D'ovidio

F. (2014). Automated discovery of watering-hole attacks. Proceedings of the 23rd International Conference on World Wide Web. The methodology involves analyzing user browsing histories

which are constructed by sessionizing raw HTTP logs. The paper notes the need to "reconstruct the browsing history of each user" as a preliminary step. (Section 3

Paragraph 2). DOI: https://doi.org/10.1145/2567948.2577325