Behavioral Profile-Based Classification of Web Application Users from System Logs

This study examines whether users of a containerized stock trading application may be classified from operational system logs and how the unit of analysis affects the resulting evaluation. The workload generator implements three predefined behavioral roles: read-only users, active trading users, and active users who additionally perform market analysis. A diagnostic event-level workflow treats individual log records as independent observations and shows that including user_id as a predictor could produce identifier-driven leakage. The substantive workflow uses the identifier only to aggregate request records into one behavioral profile per simulated user and removes it before model training. Eleven classical classifiers were evaluated separately within the available workload scenarios. In the extended 500-user scenario, which produced more than 713,000 log records, the reported five-fold cross-validation mean accuracies ranged from 92% to 100%. These high values indicate that the predefined simulated roles are strongly separable after aggregation; they do not demonstrate generalization to real users or production traffic. The result highlights the difficulty of constructing representative benchmark workloads and the need for external validation.