(e.g., owner, contractors, engineers, suppliers) from different disciplines (e.g., structural, architectural, mechanical) further increase the challenge of providing secure and efficient data exchange. The risks associated with these vulnerabilities are evident in recent cyber incidents targeting construction companies. These include data breaches (i.e., theft, modification, and exposure of sensitive data), fraudulent wire transfers, and property damages [1]. For example, hackers stole the design files of the Australian Intelligence Service's headquarters during its construction in 2013 [2]. This proves that design documents can also be valuable for malicious actors when a constructed building is of strategic importance to the government. A white paper prepared by the security software company FinalCode also presented the risks of insider threats targeting CAD files in design-centric businesses [3]. In addition, employees' and other stakeholders' personal information can be a target of attackers. For instance, Turner Construction was targeted by a phishing attack in 2016, exposing the tax information and social security numbers of its employees [4]. Similar attacks also damage the reputation of the targeted companies and can cause disruptions to business operations. Common data environments (CDEs), introduced as centralized data repositories (see Figure 1) to enhance collaboration among stakeholders in BIM-enabled projects, aim to improve data security and management [1]. However, the reliance on centralized CDEs has introduced a single point of failure, as highlighted by several studies proposing decentralized alternatives utilizing blockchain and the interplanetary file system (IPFS) [5; 6]. Protection against data theft becomes a significant challenge as the information exchange reaches its peak with the increasing use of BIM/CDE tools, particularly in design-build and integrated project delivery (IPD) projects [7]. Several document types can be sensitive depending on the project type. For example, the cost and profitability calculations and financial forecast files of large-scale projects are considered confidential. Such documents typically include the unit cost of constructing different elements of the structure, procurement and subcontract details for different materials and services, and the project's cash flow. Therefore, a potential leakage of such documents would give a competitive advantage to the rivals of the construction company, resulting in financial loss. Another sensitive document would be design files, especially considering the construction of buildings such as embassies, prisons, military bases, and critical government buildings. Even though the provided examples of cyberattacks were conducted by external actors, the motivation and consequences would be similar in case of insider threat. [PERSON] et al. [8]  
Figure 1: Common data environment (CDE). and [PERSON] et al. [1] pointed out that various stakeholders involved in construction projects might be motivated to act as malicious insiders for various reasons, including financial gain and espionage. These motivations are aligned with the previous examples of external cyberattacks targeting construction companies. Supporting these claims, a recent survey on cybersecurity in the construction industry reported that 20% of the respondents considered malicious insider threats the highest-level concern [9]. Moreover, considering that the insiders might have legitimate access to the CDE and the mentioned sensitive documents, detection can be more complicated and the outcomes can be more devastating. Addressing insider threats within CDEs is paramount for safeguarding sensitive construction project data, which constitutes the primary motivation of this study. Mitigating these risks requires proactive strategies beyond traditional cybersecurity measures to encompass insider threat detection and response.