## 4 Dataset
### Data Acquisition
```
1:Define feature columns as features related to different abnormal behaviors
2:featureCols \(\leftarrow\) {Features of different abnormal behaviors}
3:Define target columns representing the anomalous behaviors
4:targetCols \(\leftarrow\) {All anomalous behavior indicators}
5:Initialize SMOTEENN resampling
6:smote_enn \(\leftarrow\) SMOTEENN()
7:Balance data for each anomalous behavior:
8:foreach targetColi targetColi do
9:X_resampled, y_resampled \(\leftarrow\) smote_enn.fit_resample(data[featureCols], data[targetColi])
10:Update data with resampled X and y for current targetColi
11:endfor
12:Handling Missing Values:
13:Impute missing values with 1 across resampled dataset
14:This conservative imputation treats missing values as potential indicators of anomalous activity
15:Outlier Detection and Treatment:
16:foreach feature in featureCols do
17:Check if values are outside the range {0, 1}
18:If a value is outside the range, set it to 1 to indicate potentially risky behavior
19:endfor
20:
21:return Resampled, imputed, and outlier-adjusted dataset
```
**Algorithm 2** Data Validation

### Data Privacy

To ensure the ethical use of data and address privacy concerns, we implemented the following measures:

1. Pseudonymized Alerts: Users remain pseudonymized during the alert and monitoring phase, allowing for risk assessment without revealing sensitive information (see Figure 2). 2. Controlled Access for De-anonymization: When corrective action is necessary, full identification is restricted to authorized personnel, maintaining privacy until intervention is required. ## 5 Tool Validation

This section evaluates the proposed tool using real-time simulations to test the experimental setup and process as well as a comparison with different ML models in terms of different metrics for assessing performance. Finally, it examines detection and classification times to demonstrate the tool's real-time capabilities. ### Real-Time Simulation

To test the ability of the proposed tool to detect, analyze, and classify employee risk levels in real time, a simulator was created with the following components:

1. The system used for this research was a Windows 11 Pro 64-bit HP laptop equipped with an Intel(R) Core(TM) i5-10210U CPU and operating at a base speed of 1.60 GHz with a maximum clock speed of 2.11 GHz. The laptop featured 8 GB of RAM and a 64-bit operating system running on an x64-based processor. This configuration was sufficient for conducting the experiments in this study. 2. The laptop was equipped with Intel(R) UHD Graphics provided by Intel Corporation, featuring an internal DAC type. It offered a total memory of 4147 MB, including 128 MB of dedicated VRAM. The display operated at a resolution of 1366 \(\times\) 768 with 32-bit color depth and a 60 Hz refresh rate. 3. Anaconda was utilized as the primary environment manager to enable the installation and management of the required Python libraries. Python served as the main programming language, with key libraries such as Pandas and NumPy used for data manipulation, Scikit-learn for implementing ML models (RandomForest, LogisticRegression, and SVM), and XGBoost for advanced gradient boosting. The Faker library was employed to generate synthetic employee data such as names, emails, and behaviors to simulate various anomalous activities. 4. Flask was used to set up a REST API for simulating the injection of employee behaviors. POSTMAN was the API testing platform used to inject behaviors into the simulation and retrieve results. The simulation involved pushing the dataset into the system to evaluate how different ML algorithms detect and classify employees based on anomalous behaviors. Algorithm 3 shows the real-time monitoring and abnormality detection process. The simulation begins by capturing ongoing activities as the system remains active. The algorithm continuously gathers real-time data from the adjusted dataset and updates a monitoring dashboard with the latest activities.