Feature-Engineered Mouse Dynamics Dataset For Anomaly Detection

Feature-Engineered Mouse Dynamics Dataset For Anomaly Detection:This repository contains a preprocessed and feature-engineered dataset derived from raw mouse dynamics logs. The preprocessing pipeline was developed in Python and transforms low-level cursor activity into structured, high-dimensional behavioral features. The dataset is suitable for advanced research and practical applications in anomaly detection, behavioral biometrics, and cyber threat analytics.Preprocessing WorkflowThe preprocessing logic performs a comprehensive transformation of the raw data using the following stages:Raw Data IngestionCaptures the following fields from each mouse event:<code>x</code>, <code>y</code> coordinates<code>client_timestamp</code> (in milliseconds)Mouse <code>button</code> and <code>state</code> (Pressed/Released)Active application <code>window</code>Data is sourced from three subdirectories per user: <code>training</code>, <code>internal_tests</code>, and <code>external_tests</code>Kinematic Feature ComputationDerives time-dependent physical features:<code>velocity</code>, <code>acceleration</code>, <code>jerk</code>, and <code>curvature</code>Accounts for timestamp anomalies, division-by-zero, and missing valuesApplies directional smoothing and curvature approximation using angular differencesSession-Based Feature EngineeringComputes the following per session:<code>session_duration</code>, <code>total_distance</code><code>num_actions</code>, <code>num_clicks</code>, <code>num_strokes</code><code>mean_time_per_action</code>, <code>avg_drag_time</code>Statistical AggregationFor each derived motion variable, the following descriptors are computed:<code>mean</code>, <code>std</code>, <code>min</code>, <code>max</code>, <code>median</code>, <code>25th percentile (q25)</code>, <code>75th percentile (q75)</code>Label AlignmentMerges session-level features with binary labels from <code>labels.csv</code><code>risk = 0</code>: Normal session<code>risk = 1</code>: Anomalous session (e.g., unauthorized access)Ensures every row is traceable via <code>session_name</code>Output GenerationFinal output: <code>featurized_mouse_data.csv</code>Includes:All engineered features<code>session_name</code>, <code>serial_no.</code>, and <code>risk</code> labelFeature OverviewThe dataset includes over 38 features for each session, categorized into:Behavioral: Session time, distance, clicks, strokesKinematic: Velocity, acceleration, jerk, curvature (with summary stats)Interaction Metrics: Average drag time, time per actionApplicationsThis dataset is designed for academic and industrial use in:Insider threat and anomaly detection researchBehavioral biometric authentication modelsMouse-based session profiling and user verificationUnsupervised and semi-supervised machine learning pipelinesData Integrity and LoggingA robust logging system records all processing steps in <code>mouse_data_processing.log</code>Invalid or corrupt sessions are automatically skipped with traceable warnings用于异常检测（Anomaly Detection）的特征工程化鼠标动力学数据集（Feature-Engineered Mouse Dynamics Dataset For Anomaly Detection）：本仓库包含从原始鼠标动力学日志中提取的经预处理与特征工程处理的数据集。该预处理流水线基于Python开发，可将低层级的光标活动转换为结构化的高维行为特征。本数据集适用于异常检测、行为生物识别（Behavioral Biometrics）以及网络威胁分析（Cyber Threat Analytics）领域的前沿研究与实际应用。 预处理工作流 预处理逻辑通过以下阶段完成对原始数据的全面转换： 原始数据摄入 从每个鼠标事件中捕获以下字段：<code>x</code>、<code>y</code>坐标，<code>client_timestamp</code>（单位：毫秒），鼠标<code>button</code>与<code>state</code>（按下/释放），以及当前活动应用的<code>window</code>。数据按用户分为三个子目录：<code>training</code>、<code>internal_tests</code>与<code>external_tests</code>。 运动学特征计算 推导随时间变化的物理特征：<code>velocity</code>（速度）、<code>acceleration</code>（加速度）、<code>jerk</code>（加加速度）与<code>curvature</code>（曲率）。该步骤会处理时间戳异常、除零错误与缺失值，并通过角度差实现方向平滑与曲率近似。 基于会话的特征工程 为每个会话计算以下特征：<code>session_duration</code>（会话时长）、<code>total_distance</code>（总移动距离）、<code>num_actions</code>（操作总数）、<code>num_clicks</code>（点击次数）、<code>num_strokes</code>（滑动次数）、<code>mean_time_per_action</code>（单次操作平均耗时）与<code>avg_drag_time</code>（平均拖拽时长）。 统计聚合 针对每个推导得到的运动变量，计算以下统计描述符：<code>mean</code>（均值）、<code>std</code>（标准差）、<code>min</code>（最小值）、<code>max</code>（最大值）、<code>median</code>（中位数）、<code>25th percentile (q25)</code>（25分位数，q25）与<code>75th percentile (q75)</code>（75分位数，q75）。 标签对齐 将会话级特征与<code>labels.csv</code>中的二元标签进行合并：<code>risk = 0</code>表示正常会话；<code>risk = 1</code>表示异常会话（例如未授权访问）。所有行均可通过<code>session_name</code>进行溯源。 输出生成 最终输出文件为<code>featurized_mouse_data.csv</code>，包含所有工程化特征、<code>session_name</code>、<code>serial_no.</code>与<code>risk</code>标签。 特征概览 本数据集为每个会话提供超过38个特征，可分为以下类别： - 行为类特征：会话时长、移动距离、点击次数、滑动次数 - 运动学类特征：速度、加速度、加加速度、曲率及其统计摘要 - 交互指标：平均拖拽时长、单次操作耗时 应用场景 本数据集面向学术与工业界应用，适用于： 1. 内部威胁与异常检测研究 2. 行为生物识别认证模型构建 3. 基于鼠标的会话画像与用户验证 4. 无监督与半监督机器学习流水线 数据完整性与日志记录 系统配备完善的日志系统，会将所有处理步骤记录至<code>mouse_data_processing.log</code>中。无效或损坏的会话会被自动跳过，并生成可溯源的警告信息。