Method for detecting abnormal session

A method for detecting an abnormal session including a request message received by a server from a client and a response message generated by the server, the method comprising:

• transforming at least a part of messages included in the session into data in the form of a matrix;
• transforming the data in the form of the matrix into a representation vector, a dimension of which is lower than a dimension of the matrix of the data, using a convolutional neural network;
• and
• determining whether the session is abnormal by arranging the representation vectors obtained from the messages in an order in which the messages are generated to compose a first representation vector sequence, and analyzing the first representation vector sequence using a long short-term memory (LSTM) neural network,
• wherein the determining of whether the session is abnormal includes determining whether the session is abnormal on the basis of a difference between the first representation vector sequence and the second representation vector sequence.