Code and results for "Hybrid User and Entity Behavior Analytics for Insider-Threat Detection: A Comparative Study of Statistical Profiling, Machine-Learning and Sequence-Based Behavior Models"

This record contains the simulator, detector implementations, experiment scripts, result tables and figures that support the paper named above. It lets readers regenerate every table and chart in the paper. Study summary. The study compares User and Entity Behavior Analytics (UEBA) profiling, using per-user and peer-group baselines, with Isolation Forest, Local Outlier Factor, One-Class SVM, an autoencoder and a per-user Markov sequence model. It also evaluates five hybrid combinations. Every detector is evaluated under one protocol with a fixed 2% false-alert budget. Data. No real or personal data are included. All data are synthetic, generated by a simulator inspired by the structure of the CMU CERT insider-threat test datasets. The main configuration has 300 users, 90 days and three insider scenarios (data theft, job-hunting then exfiltration, sabotage). The simulator is fully determined by a random seed, so every dataset can be regenerated exactly. Seeds 0–9 are used for the main study, 100–109 for confirmation on held-out data, and further seeds for the sensitivity analyses.