Using Dirichlet Marked Hawkes Processes for Insider Threat Detection