I have access to file access data for employees in my organisation. For each employee I can see what read/write operations they carried out in the last month or so. Per operation, I see a user ID, server name, file share, directory and a flag to say if it was a Read or Write operation. I have transformed this data into one instance per user, with one column for the user id and subsequent columns for each server/fileshare/directory combination, with a 0/1 to indicate whether a user has accessed this location in the last month. From another table, I have added additional columns for business applications (there are thousands of apps), also with a 0/1 indicator to indicate whether or not a user uses a particular application.
I would like to cluster these users by similarity based on their systems access and file access profile. The ultimate aim is to see if there are users in, say, South-Africa, who have similar profiles to users in Russia. (the countries here are arbitrary). I've played around with hclust and various distance metrics in R with little success.
This is new to me and I'm just trying to understand what I should be taking into account when identifying these clusters. Are there any particular clustering techniques and distance metrics that would or would not work well for this type of problem ? Instead of using the 0/1 indicator, should I be using the total number of access counts per user per location ?