Distance Measurement Methods for Improved Insider Threat Detection

Table 1

CERT r4.2 file description.

Filename	Description
device.csv	Connection and disconnection of removable devices (e.g., USB hard drive) is described in this file.
email.csv	Contains logs of user emails.
file.csv	File access activity is provided in this file.
logon.csv	Relates to user activity based on logging on and logging off on computing devices.
psychometric.csv	Provides personality and job satisfaction variables for each of the 1000 simulated users.
LDAP	This folder contains a set of LDAP files which describe the ontology of each simulated user (their role, email, department, supervisor, etc.).