Forensic Event Reconstruction of Web Attacks Using Log Decoder and Rule-Based Correlation

Cyberattacks on web-based applications have increased in recent years. While preventive measures in web security have been widely explored, post-incident investigations, particularly event reconstruction, remain underexplored despite their pivotal role in understanding attack sequences. The complexity of this problem increases because attackers generally disguise their attacks in the form of encoded URLs. To address this problem, this study proposes an integrated event reconstruction method that combines timeline generation, log decoder, and rule-based event correlation to analyze multi-stage attack activities. The log decoder is used to transform encoded commands into their original semantics to provide clearer interpretation and improve generalization of correlation rules. The experimental evaluation was conducted using public dataset, the AIT Log Data Set V2.0 (FOX scenario), complemented by two real-world datasets to assess practical applicability. The experiment focused on server-side log artifacts from web and system servers. A total of 13 server-side log files were merged into a super timeline, preprocessed to decode hidden commands, and analyzed using correlation rules. The rules were categorized into reconnaissance, exploitation, and privilege escalation activities. The proposed method achieves 88.4% precision, 82.1% recall, and an F1-score of 85.1% against ground truth records on AIT dataset and demonstrates its ability to reconstruct the attack chain from reconnaissance to privilege escalation in web security incidents. The proposed method also proves its capability across different attack characteristics, ranging from failed to successful exploitation attempts on real-word datasets.