Anomaly Detection and Context Enrichment for Insider Threat Detection Under Extreme Class Imbalance

The OCI Audit logs generated in this experiment capture all control plane activities performed within the tenancy, including actions across Identity and Access Management and Object Storage. Each log entry records the timestamp, the operation performed (such as group modification or object access), the user identity associated with the action, and the authentication method used. The dataset includes both normal baseline behavior from admin and employee users, as well as insider activity executed via a compromised admin API key, resulting in a clear sequence of reconnaissance, privilege escalation, and sensitive data access events.本实验生成的OCI审计日志（Oracle Cloud Infrastructure Audit Logs）可捕获租户内的所有控制平面活动，涵盖身份与访问管理（Identity and Access Management）及对象存储（Object Storage）中的各类操作。每条日志记录均会留存时间戳、所执行的操作（如用户组修改或对象访问）、关联该操作的用户身份，以及所使用的身份验证方式。该数据集既包含管理员与员工用户的正常基线行为数据，也包含通过被攻陷的管理员API密钥执行的内部人员活动数据，由此形成了一套覆盖侦察、权限提升与敏感数据访问等环节的清晰事件序列。