Two Approaches:

• Statistical Anomaly Detection

• Collection of data over a period of time about legitimate user behavior

• Statistical tests to observe behavior and confidently determine non-legitimate use

  • Threshold detection: for frequency of occurrence of certain events
  • Profile-based: profile of user activity and change detection

• Successful against masqueraders but not against misfeasors