EXPERIMENTAL EVALUATION OF THE EFFECTIVENESS OF HYBRID METHODS FOR DIGITAL FOOTPRINT ANALYSIS IN DETECTING ATYPICAL BEHAVIOR IN INFORMATION AND EDUCATIONAL SYSTEMS

Abstract

Abstract. The relevance of this study is driven by the need to strengthen the security of information and educational systems (IES) of higher education institutions (HEIs), which, under martial law and widespread distance learning, have also become targets of cyberattacks. Existing IES protection methods and tools based on static signatures and access control policies have lost their effectiveness against insider threats and behavioral anomalies, such as account compromise, academic misconduct, and unauthorized delegation of privileges. The aim of this work is an experimental evaluation of the effectiveness of the developed information technology for detecting atypical user activity through hybrid analysis of their digital footprints (DF). The study is based on the hypothesis that combining structural–hierarchical modeling of business processes with ensemble machine learning (ML) methods makes it possible to significantly reduce Type I and Type II errors. To verify the proposed solutions, a series of computational experiments was conducted on a real-world dataset formed from LMS Moodle log files (over 30,000 interaction events). A comparative analysis of the developed hybrid method with classical algorithms-XGBoost gradient boosting and Isolation Forest-was performed. Experimental results demonstrate that the proposed hybrid method, which employs weighted ensemble () learning, exhibits higher discriminative power and stability. The integral quality metric ROC-AUC reached 0,956, while the balanced F1-score achieved 0,858, exceeding the baseline XGBoost performance by 4,6%. Analysis of the Precision–Recall curves confirmed the robustness of the method to class imbalance, with the area under the curve (AP) equal to 0,889. The results of the study confirm that the implementation of the proposed technology enables higher education institutions to provide flexible protection of their information and educational systems by forming a clear separation between legitimate and atypical user behavior, while minimizing the risk of blocking bona fide users.