Abstract
Today\'s computer systems are vulnerable both to abuse by insiders and to penetration by outsiders, as
evidenced by the growing number of incidents reported in the press. To close all security loopholes from today\'s systems is infeasible,
and no combination of technologies can prevent legitimate users from abusing their authority in a system; thus auditing is viewed as
the last line of defense. Over the past several years, the computer security community has been developing automated tools to
analyze computer system audit data for suspicious user behavior. This paper describes the use of such tools for detecting computer
system intrusion and describes futher technologies that may be of use for intrusion detection in the future.
