The Insider Threat Detection Method of University Website Clusters Based on Machine Learning

In recent years, the informationization construction of universities has developed rapidly. The cluster system has become a standard configuration for most university websites. However, there have been many risks and problems in the use of cluster systems, which have hindered the progress of information security in universities. Especially, the security threats caused by malicious behavior of internal personnel have posed detection difficulties due to the fuzzy boundaries and limited sample data. This paper proposes a machine learning-based log anomaly detection model, which can automatically parse and detect data in the log system for insider threats in the universities’ cluster system without the need for annotated data. Considering the differences between users, the model learns the behavior patterns of each user type based on their IP and role distinctions, and then detects abnormal behaviors based on the learned normal behavior patterns. According to experimental evaluation of user data in the cluster system of the Civil Aviation Flight University of China, the results indicate that the insider anomaly detection model proposed in this paper performs well.