October, 1988.

Today's computer systems are vulnerable to both abuse by insiders and penetration by outsiders, as evidenced by the growing number of incidents reported in the press. Because closing all security loopholes from today's systems is infeasable, and since no combination of technologies can prevent legitimate users from abusing their authority in a system, auditing is viewed as the last line of defense. What is needed are automated tools to analyze the vast amount of audit data for suspicious user behavior. This paper presents a survey of the automated audit trail analysis techniques and intrustion detection systems that have emerged in the past several years.

@article{nides-survey,
  AUTHOR = {Teresa Lunt},
  TITLE = {Automated Audit Trail Analysis and Intrusion Detection: {A} Survey},
  YEAR = {1988},
  MONTH = {oct},
  URL = {http://www.csl.sri.com/papers/survey88/}
}

• survey88.ps