Virtual cybersecurity training platforms play an important role in developing the knowledge and practice skills for students in educational institution and universities. It helps learners can access to virtual laboratory through web-interface without any geolocation restriction, especially in the Covid-19 pandemic. Furthermore, instructors can monitor and understand learners' behaviors in practice sessions by analyzing actions and logs from the virtual platform. But, to realize this feature, such a platform must gather data during cybersecurity training for data mining tasks. In this paper, we introduce a virtual laboratory platform to facilitate cybersecurity training courses, namely vLab. In addition, we apply clustering analysis on actions of learners to better understanding capabilities of trainees in resolving given challenges in digital forensics subject. With the built-in behavior analyzer in vLab, instructors can find out the common mistakes, the reasons for learner's failure result, or identify whether they actually conduct experiments to get answer in digital forensics challenges or not.
