## 4 Dataset
### Data Acquisition
### Detection and Classification Time Evaluation

This experiment evaluated the average detection and classification times of the proposed tool using four ML algorithms: LR, RF, XGBoost, and SVM. These metrics highlight

\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Study** & \multicolumn{6}{c}{**Logistic Regression (LR)**} & **Study Date** \\ \hline  & **Accuracy** & **Recall** & **Precision** & **F1-Score** & **Detection (s)** & **Classification (s)** & \\ \hline
[32] & 0.97 & 0.97 & 0.98 & 0.97 & N/D & N/D & 2021 \\ \hline
[38] & 0.93 & 0.961 & 0.912 & 0.936 & N/D & N/D & 2024 \\ \hline
[39] & 0.90 & 0.25 & 0.24 & 0.24 & N/D & N/D & 2023 \\ \hline
[55] & 0.913 & 0.91 & 0.91 & 0.90 & N/D & N/D & 2020 \\ \hline
[56] & 0.80 & 0.86 & 0.81 & 0.83 & N/D & N/D & 2020 \\ \hline
[59] & 0.70 & N/D & 0.90 & 0.54 & N/D & N/D & 2021 \\ \hline
[60] & 0.946 & 0.973 & 0.969 & 0.971 & N/D & N/D & 2022 \\ \hline Ours & 0.99 & 0.996 & 0.996 & 0.996 & 0.014 & 0.071 & N/A \\ \hline
**Study** & \multicolumn{6}{c}{**Random Forest (RF)**} \\ \hline
[32] & 0.99 & 0.99 & 0.99 & 0.99 & N/D & N/D & 2021 \\ \hline
[38] & 0.993 & 0.996 & 0.992 & 0.994 & N/D & N/D & 2024 \\ \hline
[39] & 0.99 & 0.97 & 0.97 & 0.97 & N/D & N/D & 2023 \\ \hline
[55] & 0.996 & 1.00 & 1.00 & 1.00 & N/D & N/D & 2 the tool's real-time capability and its suitability for continuous monitoring and dynamic profiling in high-security environments. #### 5.5.1 Detection Time

Detection time refers to the time required by the system to identify anomalies in employee activities, and is recorded based on the steps in Algorithm 3. This metric is crucial for ensuring timely interventions and mitigating potential risks. Table 6 presents the average detection times for the different algorithms. #### 5.5.2 Classification Time

The classification time represents the time required to assign a risk score to employees based on identified anomalies, as described in Algorithm 4, which outlines the steps involved in calculating and assigning the risk scores. Efficient classification ensures that high-risk employees are promptly flagged for administrative review. The results are shown in Table 6 and Figure 6.

As can be seen in Table 6, the experimental results demonstrate that XGBoost was the most efficient among the tested models in terms of both detection and classification times, affirming its suitability for real-time applications. In the context of detecting insider abnormal behavior, XGBoost's superior performance can likely be attributed to its ability to effectively capture complex patterns and relationships within user activity data. XGBoost leverages ensemble learning, combining multiple decision trees to improve predictive accuracy. Furthermore, it employs gradient boosting, where subsequent trees are trained to correct the errors of previous ones, leading to a more robust and accurate model. This combination of techniques allows XGBoost to identify subtle and complex patterns in user activity data that may indicate malicious intent, making it a powerful tool for insider threat detection. These findings underscore the proposed tool's potential for proactive anomaly detection and risk assessment in organizational environments. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Metric**} & **Logistic** & **Random Forest** & **XGBoost** & **Support Vector** \\  & **Regression (LR)** & **(RF)** & **XGBoost** & **Machine (SVM)** \\ \hline Detection (s) & 0.014 & 0.15 & 0.056 & 0.046 \\ \hline Classification (s) & 0.071 & 0.34 & 0.102 & 0.1051 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Average detection and classification time. Figure 6: Detection and classification times. ## 6 Conclusions

This paper underscores the critical role of real-time threat detection and classification systems in mitigating insider threats, a persistent challenge in organizational cybersecurity.