## 4 Dataset
### Data Acquisition
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Activity Type** & **Description** & **Features** & **Weight** \\ \hline Login Attempts & Logging in outside the normal business hours & Login time, number of failed attempts, & **4** \\  & & login location, and device type & **4** \\ \hline Sensitive Files Access & Unauthorized entry into confidential data & Access time, file type, access location, and user privilege & **7** \\ \hline Unauthorized Software & Installation or use of unapproved software & Installation time, user permission, and & **7** \\  & within an organization & location & **9** \\ \hline Data Transfer & Unauthorized or unmonitored transfer of & & **7** \\  & sensitive or confidential data within an & Transfer time, file size, and destination & **6** \\  & organization & & **6** \\ \hline Non-Work Websites Visited & Unauthorized access or frequent visitation of & Visit time, website category, and visit & **5** \\  & websites unrelated to work duties & frequency & **8** \\ \hline Physical Access & Unauthorized entry or access to restricted & Entry time, location accessed, and badge & **8** \\  & areas, equipment, or sensitive information & type & **8** \\ \hline Social Engineering Attacks & Deceive individuals into divulging & & **8** \\  & confidential information or performing actions & Attack type, response time, and sensitivity & **8** \\  & that compromise security protocols & & **8** \\ \hline Previous Incidents & Past security breaches, data leaks, or unauthorized activities within an & Incident type, incident date, user & **10** \\  & organization’s information systems & involvement, and incident severity & **10** \\ \hline Public Info Shared & Disclosing sensitive or confidential & Sharing time, information type, and & **5** \\  & information to the public domain & platform location & **8** \\ \hline Interaction With Malicious & Engaging with fraudulent or compromised & Interaction time, malicious flag, and user & **8** \\ Accounts & online entities & reaction & **8** \\ \hline Behavior Change & Significant alterations in an individual’s & Change type, frequency, time of change, & **6** \\  & actions or habits, often signaling potential & security concerns & **8** \\ \hline Network Interaction & Illegal engagement and communication & & **8** \\  & activities that occur within a networked & Protocol type, data volume, and frequency & **7** \\  & environment & & **9** \\ \hline Poor InfoSec Practices & Inadequate or careless information security & Practice type, frequency, user awareness, & **9** \\  & practices & and severity & **9** \\ \hline Upload Sensitive Information & Upload time, file type, encryption status, and user privilege & Upload time, file type, encryption status, & **8** \\  & Transmitting confidential or proprietary data & Send time, file type, and user privilege & **8** \\  & through various communication channels & Send time, file type, and user privilege & **8** \\ \hline Attempted Thumb Drive Insertion & Unauthorized or suspicious insertion of & & **8** \\  & external storage devices, such as USB thumb & & **8** \\  & drives, into computer systems or network & & **8** \\  & devices & & **8** \\ \hline Secure Printing & Printing documents without adequate & & **8** \\  & safeguards to protect the confidentiality and & Print time, document type, location, and & **6** \\  & integrity of the printed information & user privilege & **8** \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Abnormal behaviors description. assigned a lower weight of 4. While this behavior may raise concerns, it often has legitimate explanations, such as remote work or urgent deadlines, and as such is considered less critical in isolation. This weight assignment scheme enables the system to more effectively identify concerning behavioral patterns. An employee logging in outside business hours and visiting non-work websites might still be classified as low risk due to the relatively benign nature of these activities.