Abstract
The study presents a hybrid multi-level method for analysing the digital traces of users of information and educational systems (IES) in higher education institutions, aimed at detecting atypical behaviour and assessing information-security risks. The method integrates hierarchical structuring of event processes, graph-cluster analysis of interactions, and behavioural risk assessment based on a hybridisation of machine-learning models. The use of real event logs made it possible to demonstrate the method’s effectiveness in detecting risk-related deviations that cannot be identified using existing tools for monitoring user behaviour in information and educational systems in higher education institutions.