Your biggest problem is not the logic of the problem, but the logic of what you want to do.

You are data mining over HTTP log files. HTTP is essentially a stateless, sessionless protocol. Yet you want to measure the length of "sessions" somehow.

You're up for a failure. You want to measure something that isn't really there. And it isn't just "quitting browsing" that will spoil your day. When I hit "preview" in a minute, it's likely that it takes a while before the request goes to perlmonks, perlmonks does what it wants to do, the request is back, the ad has been fetched and the page is displayed. I'll switch to IRC, p5p or do some actual work before I return my attention to the preview page. There might be 20 minutes between hitting 'preview' and 'submit' on the next page. Did I "browse" for 20 minutes? No, I probably won't even spend 20 seconds.

Oh, did I mention that the user name for the proxy I'm using is shared with a whole bunch of people, and that we're rotating between several proxies? That would really screw up your analysis, wouldn't it? ;-)

My suggestion: give up on the idea. It's utterly useless, the data you have can't measure what you want to measure, and what you want to measure doesn't have much connection to what you want to know anyway.

Abigail