The article proposes a new approach to solving the issue of efficiency in systems of cyberattacks intelligent recognition, anomalies and threats for the educational and informational environment of universities and colleges. The solution is based on models and methodology of creating an adaptive expert system capable of self-learning. Unlike the existing ones, the model proposed in the article, takes into account the known statistical and remote parameters of cyberattacks signs’ clustering, as well as third-type errors during the machine learning process. It is proposed to evaluate the quality of signs’ space partitioning recognition of objects in an adaptive expert system with the use of a modified information performance condition as an evaluation indicator. It is proved that model and application of the method of clustering of signs based on the entropy and information-distance Kullback–Leibler criterion, allows getting the input fuzzy classified educational matrix which is used as an object of study.