Figure 7.

Average AUC of the detection models for a varying number of simulated insiders in the EHR dataset. This figure summarizes the AUC (+/- one standard deviation) of the four detection models on varying quantities of simulated intrusions, where a varying number of users are intruding per simulation, in the EHR dataset. Each simulated intruder issues three accesses. The x-axis corresponds to the number of intruding users, which ranges from 2 to 20. The y-axis is the average AUC and standard deviation of the models.