Image-Based Insider Threat Detection via Geometric Transformation

Table 1

Feature structure.

Feature = time + PC + activity
Time	Workhour, afterhour, weekend, whole	PC	Own pc, other’s pc, whole
Activity	Logon	logon_times
	File	file_oper_times, doc_oper_times, exe_oper_times
	Http	http_oper_times, job_oper_times, leak_oper_times
	E-mail	E-mail_oper_times, e-mail_mean_size_atts
	Device	usb_oper_times