CERT Insider Threat Dataset – Preprocessed Event Logs for Process Mining and Machine Learning Benchmark

This repository provides preprocessed and labeled versions of the CERT Insider Threat Test Dataset (CMU, 2020), formatted for process mining analysis with PM4Py and for direct comparison with supervised machine learning classifiers. Five files are provided: - df_g_clean_pc_def.csv: good behaviors (normal traces), case id defined by PC — defender perspective (Way I)- df_b_clean_def.csv (Way I): bad behaviors (anomalous traces), case id defined by PC — defender perspective- df_g_clean_resource_def.csv: good behaviors (normal traces), case id defined by user resource — attacker perspective (Way II)- df_b_clean_def.csv (Way II): bad behaviors (anomalous traces), case id defined by user resource — attacker perspective- cert_preprocessed_ml_comparison.csv: labeled dataset for supervised ML comparison, 4,615 events, 70/30 class distribution (normal/anomalous) All datasets are derived from the original CERT Insider Threat Test Dataset (https://doi.org/10.1184/R1/12841247.v1) and formatted to comply with PM4Py event log requirements (case id, activity, resource, timestamp).