Using Genetic Algorithm to Minimize False Alarms in Insider Threats Detection of Information Misuse in Windows Environment

Table 1

Ranges of normal, medium, and high TS values for user categories.

Class	Example users	TS (normal)	TS (medium)	TS (high)
1	Network admin, system admin	TS < 50	50 ≤ TS ≤ 75	TS > 75
2	Manager, scientist	TS < 35	35 ≤ TS ≤ 50	TS > 50
3	Clerk, data entry operator	TS < 20	20 ≤ TS ≤ 35	TS > 35