Anomaly Detection and Context Enrichment for Insider Threat Detection Under Extreme Class Imbalance

The OCI Audit logs generated in this experiment capture all control plane activities performed within the tenancy, including actions across Identity and Access Management and Object Storage. Each log entry records the timestamp, the operation performed (such as group modification or object access), the user identity associated with the action, and the authentication method used. The dataset includes both normal baseline behavior from admin and employee users, as well as insider activity executed via a compromised admin API key, resulting in a clear sequence of reconnaissance, privilege escalation, and sensitive data access events.