# Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms
## Appendix A
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Algorithm** & **0.10\%** & **0.50\%** & **1.00\%** & **3.00\%** & **5.00\%** & **7.00\%** & **10.00\%** \\ \hline Parzen + PCA & **0.0344** & **0.0667** & **0.1021** & 0.1938 & 0.3406 & 0.4771 & **0.6156** \\ Gauss + Parzen & 0.0000 & 0.0625 & 0.0625 & 0.2188 & 0.3302 & 0.3313 & 0.5302 \\ Gauss + kMeans & 0.0000 & 0.0229 & 0.0510 & 0.0896 & 0.1104 & 0.1271 & 0.1583 \\ Gauss + PCA & 0.0000 & 0.0146 & 0.0635 & 0.2344 & 0.3292 & 0.3625 & 0.4125 \\ Parzen + kMeans & 0.0010 & 0.0167 & 0.0333 & 0.1615 & 0.1927 & 0.2615 & 0.3063 \\ kMeans + PCA & 0.0135 & 0.0354 & 0.0542 & 0.1313 & 0.1979 & 0.2323 & 0.2771 \\ Gauss + Parzen + kMeans & 0.0042 & 0.0417 & 0.0677 & 0.1854 & 0.2646 & 0.3406 & 0.4052 \\ Gauss + Parzen + PCA & 0.0000 & 0.0438 & 0.0688 & **0.2500** & **0.3813** & **0.4792** & 0.5750 \\ Gauss + kMeans + PCA & 0.0167 & 0.0438 & 0.0635 & 0.1417 & 0.2156 & 0.2677 & 0.3292 \\ Parzen + kMeans + PCA & 0.0000 & 0.0323 & 0.0927 & 0.1938 & 0.2646 & 0.3313 & 0.4302 \\ Gauss + Parzen + & 0.0042 & 0.0542 & 0.1010 & 0.2344 & 0.3052 & 0.3740 & 0.4813 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: True detection rate of each anomaly detection algorithm based on the daily activity summary dataset (Salesman). Best performance is shown in bold and underlined. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Algorithm** & **0.10\%** & **0.50\%** & **1.00\%** & **3.00\%** & **5.00\%** & **7.00\%** & **10.00\%** \\ \hline Parzen + PCA & 0.3367 & 0.4300 & 0.4833 & 0.6833 & 0.7633 & 0.7800 & 0.7933 \\ Gauss + Parzen & 0.0300 & 0.3000 & 0.5767 & 0.7000 & 0.7000 & 0.7000 & 0.7000 \\ Gauss + kMeans & **0.4933** & 0.5000 & 0.5133 & 0.6033 & 0.6100 & 0.6300 & 0.6900 \\ Gauss + PCA & 0.3200 & 0.4667 & 0.5300 & 0.6400 & 0.6767 & 0.6867 & 0.6933 \\ Parzen + kMeans & 0.3133 & 0.3633 & 0.6167 & **0.7533** & 0.7633 & 0.7867 & **0.8000** \\ kMeans + PCA & 0.3400 & 0.5033 & 0.5600 & 0.6800 & 0.7267 & 0.7400 & 0.7567 \\ Gauss + Parzen + kMeans & 0.2733 & 0.5033 & 0.6033 & 0.7167 & 0.7367 & 0.7467 & 0.7900 \\ Gauss + Parzen + PCA & 0.2900 & 0.5133 & 0.6433 & 0.6900 & 0.7500 & **0.8000** & **0.8000** \\ Gauss + kMeans + PCA & 0.3267 & 0.5167 & 0.5600 & 0.6233 & 0.6867 & 0.7167 & 0.7400 \\ Parzen + kMeans + PCA & 0.3200 & **0.5667** & **0.6933** & **0.7533** & 0.7633 & 0.7700 & 0.7767 \\ Gauss + Parzen + & 0.3067 & 0.5567 & 0.6400 & 0.7333 & **0.7767** & 0.7967 & **0.8000** \\ \hline \hline \end{tabular}
\end{table} 
Table 4: True detection rate of each anomaly detection algorithm based on the daily activity summary dataset (Electrical Engineer). Best performance is shown in bold and underlined. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Algorithm** & **0.10\%** & **0.50\%** & **1.00\%** & **3.00\%** & **5.00\%** & **7.00\%** & **10.00\%** \\ \hline Parzen + PCA & 0.0029 & **0.0710** & **0.0971** & **0.1812** & **0.2174** & **0.2232** & **0.2580** \\ Gauss + Parzen & 0.0130 & 0.0435 & 0.0435 & 0.0870 & 0.1275 & 0.1304 & 0.1333 \\ Gauss + kMeans & 0.0000 & 0.0377 & 0.0449 & 0.0710 & 0.0739 & 0.0870 & 0.0899 \\ Gauss + PCA & 0.0014 & 0.0420 & 0.0435 & 0.0478 & 0.1014 & 0.1261 & 0.1536 \\ Parzen + kMeans & 0.0217 & 0.0638 & 0.0797 & 0.1101 & 0.1420 & 0.1739 & 0.2043 \\ kMeans + PCA & 0.0014 & 0.0333 & 0.0739 & 0.1014 & 0.1116 & 0.1406 & 0.1971 \\ Gauss + Parzen + kMeans & 0.0275 & 0.0464 & 0.0551 & 0.0783 & 0.0971 & 0.1130 & 0.1536 \\ Gauss + Parzen + PCA & 0.0217 & 0.0435 & 0.0522 & 0.1101 & 0.1348 & 0.1696 & 0.1797 \\ Gauss + kMeans + PCA & 0.0014 & 0.0420 & 0.0565 & 0.0768 & 0.0942 & 0.1116 & 0.1565 \\ Parzen + kMeans + PCA & 0.0246 & 0.0246 & 0.0246 & 0.0246 & 0.0246 & 0.0246 & 0.0246 \\ Gauss + Parzen + & **0.0275** & 0.0478 & 0.0652 & 0.0928 & 0.1232 & 0.1522 & 0.1957 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: True detection rate of each anomaly detection algorithm based on the daily activity summary dataset (IT Admin). Best performance is shown in bold and underlined.