AI-Based Secure Network Learning System Development for School Computer Labs

Abstract

The manual auditing of student digital-activity logs in a school computer laboratory can take up to two hours per incident, while the complexity of raw, signature-based logs frequently induces alarm fatigue among laboratory administrators. This study proposes an autonomous, narrative-driven centralized cybersecurity monitoring system that integrates an open-source SIEM framework with a cloud-based Large Language Model (LLM), using an instant-messaging platform as a ChatOps interface for report delivery. Built on a Linux server, the system employs a decoupled Python daemon architecture that separates event-driven log ingestion from AI-based analysis through an LLM middleware layer, thereby preserving the resource stability of the core monitoring manager. It captures raw process-creation event logs (Event ID 4688) from the endpoints and transforms them into clear, contextual narrative reports. Validation was performed across 50 digital-activity scenarios spanning 25 legitimate curriculum uses and 25 policy-violating anomalies, evaluated using a Confusion Matrix. The model classified every scenario correctly, producing no false positives and no false negatives for an accuracy of 100%. A five-minute cron-based batching strategy further reduced the manual investigation window from up to 120 minutes per incident to a fully autonomous five-minute cycle, while simultaneously preventing messaging-API rate-limit blocks. These findings indicate that artificial intelligence can effectively convert raw, technical endpoint logs into a communicative instrument for objectively evaluating students' digital conduct in a vocational school environment.