Finding The Bad Guy

• Need to distinguish between a masquerader and a legitimate user

• Observe past history (Bayes Theorem)

• Establish patterns of behavior

• Look for significant deviations