Design and generation of a dataset for training insider threat prevention and detection models: The SPEDIA dataset

• Hybrid methodology for insider threat dataset generation combining real, simulated, and synthetic data. • Realistic cyber exercise scenario aligned with the MITRE ATT&CK framework for dynamic attack simulation. • Balanced distribution of malicious and non-malicious events to facilitate supervised learning. • Rich event-level logging including commands, file actions, network activity, and email data. • Enhanced support for insider threat detection model training and validation in academic and research settings. The increasing complexity of insider threats poses a critical challenge for modern cybersecurity. Existing datasets used for training detection systems often lack realism, suffer from severe class imbalance, or are outdated. This paper presents a novel methodology for the generation of insider threat datasets through the integration of three data sources: (1) real user behavior collected during a controlled cyber exercise, (2) simulated user activity modeled on realistic work roles, and (3) synthetic data derived from the CERT Insider Threat Test dataset. The result is the SPEDIA dataset, designed to support the development and evaluation of machine learning models for detecting insider threats. The dataset includes detailed event-level logs of user activity, such as file manipulation, command execution, service usage, and network behavior, with annotations mapped to MITRE ATT&CK tactics and techniques. Unlike previous datasets, SPEDIA achieves a more balanced distribution of malicious and non-malicious events, enhancing its suitability for supervised learning. This work also provides a replicable framework for generating similar datasets, contributing to the advancement of insider threat detection research and the development of robust, real-world mitigation strategies.