Systems and methods for dynamic session aggregation detection include receiving session logs for one of a plurality of machines operating in a cloud-based system; determining a plurality of time intervals between activities based on the session logs; determining a probability of a new log to be received after each time interval of the plurality of time intervals; calculating a slope from a shortest break interval and a slope to a longest break interval for each log of the session logs; calculating a slope ratio for each log of the session logs; and determining an optimal maximum session duration based on the slope ratios. The steps further include defining a new applicative session each time the machine experiences a break larger than the optimal maximum session duration.