According to one embodiment of the present invention, a method for reconstructing client web page accesses is provided that comprises capturing network-level information for client accesses of at least one web page. The method further comprises constructing a knowledge base of reliable information identifying content of at least one web page, and reconstructing at least one client web page access from the captured network-level information using the reliable information of the knowledge base.