An Integrated SIEM Approach for Real-Time Threat Detection and Log Analytics in Higher Education ERM Systems

Abstract

Data related to academics, administration, and sensitive institutional information is increasingly handled by Enterprise Resource Management (ERM) systems in modern higher education institutions. Systems of this type become more vulnerable to cybersecurity threats as they grow in scale and functionality. Specifically developed for an educational institution's ERM ecosystem, this paper presents the design and implementation of a customized Security Information and Event Management (SIEM) solution. By centralizing and normalizing logs generated from student, faculty, and administrative portals, the proposed system allows real-time monitoring and analysis of system activities. A SIEM integrates rule-based mechanisms with machine learning models for detecting anomalies, unauthorized access, privilege abuse, and abnormal user behavior. A dynamic and intuitive dashboard provides administrators with immediate visibility into security events, alerts, and emerging trends derived from collected log data. Logs are processed through classification and correlation engines to create accurate, high-confidence alerts. In experiments, improvements were demonstrated in the accuracy of anomaly detection, the efficiency of logging, and the reliability of alerting. In addition to strengthening security awareness and supporting compliance and auditing, the solution provides a cost-effective, scalable framework for safeguarding academic ERM systems.