Improved Insider Threat Detection Method of University Cluster System based on Log-Clustering

In response to the low accuracy issue of the log-based clustering method for insider threat detection in university cluster systems, this study proposes an improved log-based clustering method for insider threat detection. Firstly, when dividing logs into log sequences, we consider the differences between different users. We classify the logs based on user accounts and use a sliding window approach to divide the classified logs into labeled log sequences for subsequent clustering learning. This approach takes into account the behavioral pattern differences between different users. Additionally, in practical applications, the output results of the model are manually inspected, misjudgments are marked, and the model is iterated using the labeled data to improve its accuracy. Experimental results demonstrate that the improved internal threat detection method effectively enhances the detection accuracy and is more suitable for real-world production environments.