In today's IT world computer systems are vulnerable by both insiders (i. e. employees) as well as penetration by outsiders (or attackers). Also there are evidences showing the growing number of incidents reported in the press for such abuse. Closing all security loopholes from today's system is infeasible, whereas no combination of technologies can prevent legitimate users from abusing their authority in a system, auditing in viewed as the last line of defense. But auditing a large amount of data is not a feasible option hence what is needed is automated tools to analyze the vast amount of audit data for suspicious user behavior. This paper presents audit trail analysis technique and intrusion detection systems that have emerged in the past several years.

1. http://www. academypublisher. com/proc/isnns10/paper/isnns10p275. pdf
2. http://www. lexjansen. com/pnwsug/2004/ExtractingDatafromOracleintoSAS-LessonsLearned. pdf
3. https://support. sas. com/training/tutorial/el/libsppg3_at. pdf
4. http://www. atis. org/glossary/definition. aspx?id=5572
5. http://www. datamation. com/columns/article. php/3578916/The-Importance-of-Audit-Logs. htm
6. http://csrc. nist. gov/

System Log Audit Trail