Is there any experience in clustering users according to the activity log?

Question

data mining

There is a task to cluster users according to the activity log from the forum. The ultimate goal is to divide user activity into good and suspicious in terms of the actions performed. Does anyone have experience and case studies of such a task?

Answer 1

This is a behavior-based binary classification task (anomaly detector).
You need to think carefully about what signs of the user (session) you can extract from the log.
One of the possible solutions is association rules: en.wikipedia.org/wiki/Association_rule_learning
On a sample of data with good users, you train the model (you form rules). At test sessions, you evaluate the quality of the detector (correct and false classification). If the quality is not satisfactory, you add new features to the model.

Answer 2

Can you be more specific about what interests you?
Heuristics of suspicious - not suspicious behavior? Ways to track this very activity? Clustering activities by users? What?