Distance Measurement Methods for Improved Insider Threat Detection

Table 2

Numeric labels for activities.

Activity	Numerical label
User logs on to a device.	1
User logs off a device.	2
User connects a removable device.	3
User disconnects a removable device.	4
User browses the web.	5
User sends or receives email.	6
User performs file manipulation tasks.	7