Security Log Analysis of A Healthcare Web Application Using LLM Classification and Unsupervised Clustering
Journal of Decision Making and Healthcare, Volume 3, Issue 2, August 2026, Pages: 123–133
CHAWALIT CHANINTONSONGKHLA
School of Dentistry, University of Phayao, Phayao, Thailand
PRASIT WONGSUPA
Phayao Provincial Public Health Office, Phayao, Thailand
MOHAMMAD FARID
Department of Mathematics, College of Science, Qassim University, Saudi Arabia
Abstract
Healthcare web applications require periodic security auditing, yet many institutions lack dedicated security staff to review server logs. This study applied artificial intelligence (AI)-assisted log auditing to a healthcare web application at a Thai university. A total of 158,720 structured log entries collected over 163 days across three logging schema iterations were analyzed using two complementary methods. For threat classification, a large language model (LLM; GPT-5 Nano) classified batches of log entries along two dimensions (intent and impact) using structured JSON output. For pattern visualization, sentence embeddings of the log entries were projected to two dimensions using Uniform Manifold Approximation and Projection and clustered with Hierarchical Density-Based Spatial Clustering of Applications with Noise. The analysis identified 26 semantic clusters spanning six categories: attack traffic (10.4 % of entries), security events (1.9 %), probing (0.65 %), routine operations (23.9 %), system maintenance (3.3 %), and mixed (0.9 %), with the remaining 59.0 % classified as noise. A single-day automated scanning flood accounted for the majority of attack-related entries. The results suggest that periodic large language model-assisted auditing can monitor web access patterns in production logs without requiring predefined signatures, and that embedding-based clustering provides a visual overview of traffic composition and security posture.
Cite this Article as
Chawalit Chanintonsongkhla, Prasit Wongsupa, and Mohammad Farid, Security Log Analysis of A Healthcare Web Application Using LLM Classification and Unsupervised Clustering, Journal of Decision Making and Healthcare, 3(2), 123–133, 2026