Overview of methods for static and dynamic clustering of security event logs

Security event log files provide insight into the state of the information system and allow detecting anomalies in user behavior and information security incidents. However, automatic analysis of security event log data is difficult because it contains a huge amount of unstructured data collected from various sources. This article provides an overview of existing approaches that condense or summarize log data using clustering methods, namely static and dynamic clustering methods. The study examines the examples of using static and dynamic clustering of security event logs as well as limitations and problems in the use of these methods.