## 4 Dataset
### Data Acquisition
Additionally, factors such as job satisfaction levels could provide valuable insights into why an employee is engaging in specific behaviors, such as attempting to access sensitive files. By considering these psychological and contexttual elements, the system could offer a more nuanced understanding of employee behavior, helping it to distinguish between genuine security risks and actions driven by external pressures or dissatisfaction. Future research should explore federated learning or decentralized data sharing approaches as a means to preserve privacy while leveraging real-world data for analysis. Federated learning enables organizations to train models locally, sharing only aggregated updates rather than sensitive raw data, thereby maintaining confidentiality. Similarly, decentralized data sharing techniques that rely on anonymized or partially processed datasets can help to ensure privacy. Collaborating with industry partners to access such anonymized datasets would enhance these efforts by providing a diverse and representative pool of real-world data. This collaboration would ensure that the system benefits from practical real-world scenarios while maintaining the ethical standards required for handling sensitive employee information. Expanding the proposed tool's scalability and interoperability with existing security systems, such as SIEM platforms or identity management tools, could increase its adoption in real-world scenarios. To integrate our tool with current cybersecurity setups, this would involve establishing communication channels between the tool and SIEM systems to share relevant employee activity data such as login attempts and access logs. This would allow the tool to leverage real-time data streams from the SIEM platforms to more accurately detect and classify anomalous behaviors. Additionally, integration with identity management software could enable the tool to assess access patterns, user roles, and permissions, improving its ability to identify risky behavior based on unauthorized or abnormal access attempts. Such integration would ensure that the tool complements existing cybersecurity infrastructure and enhances overall threat detection capabilities. Finally, the proposed tool provides a significant step forward in addressing insider threats, offering an innovative and practical approach that bridges the gaps in existing methods. This research paves the way for more effective, scalable, and interdisciplinary solutions, helping to ensure enhanced security in an increasingly complex digital landscape. Conceptualization, S.A.-D.Q. and A.A.S.A. ; methodology, S.A.-D.Q. and A.A.S.A. ; software, S.A.-D.Q. and A.A.S.A. ; validation, S.A.-D.Q. and A.A.S.A. ; formal analysis, S.A.-D.Q. and A.A.S.A. ; resources, S.A.-D.Q. and A.A.S.A. ; data curation, S.A.-D.Q. ; writing--original draft preparation, A.A.S.A. ; writing--review and editing, S.A.-D.Q. ; visualization, S.A.-D.Q. ; supervision, A.A.S.A. All authors have read and agreed to the published version of the manuscript. This research received no external funding. The dataset presented in this study is available on request. The authors declare no conflicts of interest. ## References

* Verizon (2024) Verizon. _2024 Data Breach Investigations Report_; Technical Report; Verizon: New York, NY, USA, 2024. * IBM (2024) IBM. _Cost of a Data Breach Report 2024_; Technical Report; IBM: Armonk, NY, USA, 2024. * [PERSON] (2021) [PERSON]; [PERSON] Exploring anomalous behaviour detection and classification for insider threat identification. _Int. J. Netw. Manag._**2021**, _31_, e2109. [CrossRef]
* [PERSON] et al. (2024) [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Enhancing Insider Threat Detection in Imbalanced Cybersecurity Settings Using the Density-Based Local Outlier Factor Algorithm. _IEEE Access_**2024**, _12_, 34820-34834. [CrossRef]
* [PERSON] et al.