## 4 Dataset
### Data Acquisition
\begin{table}
\begin{tabular}{c c} \hline \hline
**Variable** & **Encoded Values** \\ \hline Sharing Time & Working Hours (0), Non-Working Hours (1) \\ \hline Information Type & Personal (0), Professional (1), Sensitive (2) \\ \hline Platform Location & Internal (0), External Public (1), External Private (2) \\ \hline Interaction Time & Working Hours (0), Non-Working Hours (1) \\ \hline Malicious Flag & Not Malicious (0), Malicious (1) \\ \hline User Reaction & None (0), Minimal (1), Full (2) \\ \hline Change Type & Behavioral (0), Habitual (1), Sudden (2) \\ \hline Time of Change & Working Hours (0), Non-Working Hours (1) \\ \hline User Motivation & Work Related (0), Personal (1), Suspicious (2) \\ \hline Protocol Type & HTTP (0), HTTPS (1), FTP (2), SMTP (3) \\ \hline User Awareness & Fully Aware (0), Partially Aware (1), Unaware (2) \\ \hline Practice Type & Weak Passwords (0), Sharing Credentials (1), Lack of Updates (2) \\ \hline Severity & Low (0), Medium (1), High (2) \\ \hline Upload Time & Working Hours (0), Non-Working Hours (1) \\ \hline Encryption Status & Not Encrypted (0), Encrypted (1) \\ \hline Send Time & Working Hours (0), Non-Working Hours (1) \\ \hline Insert Time & Working Hours (0), Non-Working Hours (1) \\ \hline Print Time & Working Hours (0), Non-Working Hours (1) \\ \hline Document Type & Personal (0), Official (1), Confidential (2) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: _Cont._
```
PoorInfoSecPractices: 9, UploadSensitiveInformation: 8, SendsSensitiveInformation: 8, AttemptedThumbDrivisInsertion: 10, SecurePrinting: 6 } Add features for each anomalous behavior and assign values: for each feature in anomalous_weights do  Assign values to features based on pre-defined behavior criteria endfor Generate feature values: for each feature and corresponding weight in anomalous_weights do  Assign binary value (0 or 1) to feature for each employee, based on the corresponding feature values endfor InitializeRiskScore to 0 for each employee returnData with synthesized employee details and features
```
**Algorithm 1**_Cont._

### Feature Engineering

To enhance risk assessment, we introduced a composite _RiskScore_ feature calculated using Equation (1), which incorporates both activity frequency and risk weight. The score is based on the first occurrence of an abnormal activity multiplied by the corresponding activity's weight. Users are then labeled according to their _RiskScore_ as low risk (0-10), medium risk (10-25), or high risk (above 25). These thresholds are designed to detect risky users at early stages. Organizations can modify these ranges according to their specific requirements. ### Data Validation

Ensuring data quality and reliability is essential. We performed several preprocessing steps to clean the data, which are illustrated in Figure 3 and summarized as follows:

Figure 3: Data cleaning and preprocessing workflow. Handling Missing Values: Missing values were imputed as 1, aligning with the goal of detecting the first instance of anomalous activity. This conservative approach minimizes the risk of false negatives by assuming that missing values may indicate potential anomalous activities. 2. Outlier Detection and Treatment: Frequency values outside the {0, 1} range were adjusted to 1, treating these anomalies as indicators of potentially risky behavior. Our dataset did not exhibit outliers outside this range. 3. Addressing Dataset Imbalance: We employed the Synthetic Minority Oversampling Technique combined with Edited Nearest Neighbors (SMOTEENN) to balance the representation across anomalous behaviors, which is crucial for effective model training. The process for data validation is shown in Algorithm 2.