  Due to the precautionary measures during the COVID-19 pandemic many
universities offered unproctored take-home exams. We propose methods to detect
potential collusion between students and apply our approach on event log data
from take-home exams during the pandemic. We find groups of students with
suspiciously similar exams. In addition, we compare our findings to a proctored
control group. By this, we establish a rule of thumb for evaluating which cases
are "outstandingly similar", i.e., suspicious cases.
