Table 3 Descriptions for the selected features.

From: Comparative evaluation of data imbalance addressing techniques for CNN-based insider threat detection

Feature

Description

hour_of_day

The numeric representation of the hour in which an event occurred (1–24)

day_of_week

The numeric or string representation of the day of the week

user

The identifier for the user involved in an event

pc

The identifier for the computer used in the event

action

The type of action that was recorded (like login, file access, etc.)