A computing device accesses a session log that includes a recording of user interactions of a user during a session with an application instance in a computing environment. The computing device cleanses the session log to remove a portion of the content included in the session log to generate a cleansed session log and converts the cleansed session log into a session vector representation using a finite dictionary built from a plurality of session logs associated with a plurality of users that have interacted with the computing environment. The computing device generates a user model for the user using the session vector representation and a plurality of other session vector representations associated with the user. The model may be used to perform management and security operations in the computing environment.