Distance Measurement Methods for Improved Insider Threat Detection

Figure 2

HMM result for CERT user MCF0600 based on methodology by [12].