## 4 Dataset
### Data Acquisition
```
1:Initialize data structure to capture real-time activities
2:whilesystem is activedo
3: Capture real-time data from the adjusted dataset
4: Append captured data to data structure
5: Update monitoring dashboard with latest activities
6:endwhile
7:
8:return Captured activities data
9:activitiesData \(\leftarrow\) Call ContinuousMonitoring(adjustedDataset)
10:Split activitiesData into training, validation, and test sets with 70-15-15 ratio
11:trainingData, validationData, testData \(\leftarrow\) split(activitiesData, 0.7, 0.15, 0.15)
12:behaviorTypes \(\leftarrow\) Identify distinct abnormal behavior types in activitiesData
13:for each behaviorType in behaviorTypesdo
14: correspondingFeatures \(\leftarrow\) Extract features specific to behaviorType
15: models \(\leftarrow\) Initialize [RF, LR, XGBoost, SVM]
16:foreach model in modelsdo
17: Fit model using correspondingFeatures
18: model.fit(trainingData[ correspondingFeatures])
19:endfor
20:endfor
21:for each activity in activitiesDatado
22:foreach behaviorType in behaviorTypesdo
23: correspondingFeatures \(\leftarrow\) Extract features specific to behaviorType
24:foreach model in modelsdo
25: prediction \(\leftarrow\) model.predict(activity[ correspondingFeatures])
26:if prediction indicates abnormality then
27: Log abnormal activity for further analysis
28: Notify security team about abnormal activity
29: Generate alert with details:
30: alert \(\leftarrow\) Create alert with employee name, ID, behavior type, and time of occurrence
31: Send alert to cybersecurity team
32: Calculate the detection time
33:endif
34:endfor
35:endfor
36:endfor
37:
38:return List of identified abnormal activities
```
**Algorithm 3** Continuous Activities, Identification, and Alert
```
1:Input: Employee activities data
2:for each employee in activitiesData do
3:riskScore \(\leftarrow\) 0
4:for each feature in features do
5:if feature value for employee is 1 then
6:riskScore \(\leftarrow\) riskScore + Weight[feature]
7: Add Gaussian noise to RiskScore to simulate variability
8:endif
9:endfor
10: employee['riskScore'] \(\leftarrow\) riskScore
11:endfor
12:for each employee in activitiesData do
13: Update employee profile with latest behaviors and riskScore
14:endfor
15:for each employee in activitiesData do
16:if riskScore less than lowThreshold then
17: employee['riskLabel'] \(\leftarrow\) low
18: else ifiskScore less than mediumThreshold then
19: employee['riskLabel'] \(\leftarrow\) moderate
20: else
21: employee['riskLabel'] \(\leftarrow\) high
22: Calculate the scoring and classification time
23:endif
24:endfor
25:
26:return Updated employee profiles with riskScores and riskLabels
```
**Algorithm 4** Employee Risk Classification and Dynamic Profiling
```
1:Initialize data structure for notifications
2:for each employee in activitiesData do
3:if employee['RiskLabel'] is Moderate or High then
4: notification \(\leftarrow\) Create notification with details:
5: notification['Employee Name'] \(\leftarrow\) employee['Name']
6: notification['Employee ID'] \(\leftarrow\) employee['ID']
7: notification['Risk Level'] \(\leftarrow\) employee['RiskLabel']
8: notification['Abnormal Behaviors'] \(\leftarrow\) Get abnormal behaviors for employee
9: notification['Time of Occurrence'] \(\leftarrow\) Get time of occurrence
10: Send notification to administration
11:endif
12:endfor
13:Log notifications for review
14:Return notifications sent to administration
15:Reinitialize monitoring process
16:while system is active do
17: Capture new real-time data from the organization's network
18: Append captured data to activitiesData
19: Update monitoring dashboard with latest activities
20:endwhile
```

**Algorithm 5** Administration Notification and Recurrence

### ML Models

As part of the evaluation process, several ML models were selected in order to assess their ability to detect anomalous behavior and classify user risk based on their behavior.