The article describes the method of identification of abnormal actions of users of corporate computer systems based on the analysis of log files. The proposed method is based on the clustering of system log events by The IPLoM algorithm and the construction of an event count matrix for its further analysis using machine learning methods.
Keywords: machine learning, information security, data analysis, syslog monitoring, log file, IPLoM