Data mining computer audit logs to detect computer misuse

All computers are vulnerable to misuse either by unauthorized users penetrating the system or by authorized users abusing their privileges. This paper describes the use of a data mining process to sift through large (gigabytes) computer audit log databases to detect potential improper accesses of sensitive data files by authorized users. Computer audit logs record information about what files were accessed by which users and when. The detection of computer misuse is important because computer misuse can be related to acts of computer fraud, information theft, software piracy, and violations of privacy, to name a few. The data mining process described in this paper can be applied to detect possible fraud in a wide variety of situations that share some common characteristics: first, a class of ‘sensitive’ files can be identified which may be subject to improper access; second, the selection of files by users is a random process; and third, the probability that a user‐selected file is from the sensitive class should be the same for all members of a group of users. Examples of possible applications of the data mining process include detecting inappropriate accesses to classified files, celebrity files, financial accounts with high balances, and files known to have been improperly used. © 1998 John Wiley & Sons, Ltd.