Data mining computer audit logs to detect computer misuse

Sharon Kay Heatley and James R. Otto

Intelligent Systems in Accounting, Finance and Management, 1998, vol. 7, issue 3, 125-134

Abstract: All computers are vulnerable to misuse either by unauthorized users penetrating the system or by authorized users abusing their privileges. This paper describes the use of a data mining process to sift through large (gigabytes) computer audit log databases to detect potential improper accesses of sensitive data files by authorized users. Computer audit logs record information about what files were accessed by which users and when. The detection of computer misuse is important because computer misuse can be related to acts of computer fraud, information theft, software piracy, and violations of privacy, to name a few. The data mining process described in this paper can be applied to detect possible fraud in a wide variety of situations that share some common characteristics: first, a class of ‘sensitive’ files can be identified which may be subject to improper access; second, the selection of files by users is a random process; and third, the probability that a user‐selected file is from the sensitive class should be the same for all members of a group of users. Examples of possible applications of the data mining process include detecting inappropriate accesses to classified files, celebrity files, financial accounts with high balances, and files known to have been improperly used. © 1998 John Wiley & Sons, Ltd.

Date: 1998
References: Add references at CitEc
Citations: View citations in EconPapers (1)

Downloads: (external link)
https://doi.org/10.1002/(SICI)1099-1174(199809)7:33.0.CO;2-L

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:wly:isacfm:v:7:y:1998:i:3:p:125-134

Ordering information: This journal article can be ordered from
http://www.blackwell ... bs.asp?ref=1099-1174

Access Statistics for this article

More articles in Intelligent Systems in Accounting, Finance and Management from John Wiley & Sons, Ltd.
Bibliographic data for series maintained by Wiley Content Delivery ().