Use Of Network Activity Monitoring System To Solve Problems Case Study Of Benue Internal Revenue Service

File activity monitoring products are designed to monitor the patterns of legitimate users accessing enterprise file stores and alert security administrators to unusual activity. FAM is designed to go above and beyond the access control and logging capabilities built-in to operating systems, providing a usable way to perform both proactive and reactive security monitoring.
FAM solutions could be used to:
Track file access in real time and take action when abnormal activity is detected. The definition of "abnormal" may be customized to individual users, groups or the entire organization.
Audit all accesses to a file in the event of a data leak to assist with the investigation.
Identify all files accessed by a particular user who is suspected of corporate espionage.
Identify users that have access permissions but are not using them. This may be especially helpful when performing audits designed to identify permissions that have accumulated as a result of privilege creep but are no longer necessary.
2.10    Detecting Insider Threats by Monitoring System Call Activity
(Kuenning et al, 2001) analysed the detection of inside threats by monitoring system call activities. In their paper, they analysed there results using system call traces to see if it is possible to detect insider threats by monitoring file access and process activity, raw data are looked at in a different manner: the relationships between users and files, users and processes, and processes and files. By analysing these models and relationships, the authors want to learn whether it is possible to build an effective insider threat detection system for each of these relationships. If any of the models do not work, they want to discover the reasons and all technical difficulties behind the problem. Furthermore, they want to discover any characteristics or promising approaches that can help to build good profiles for users and processes. As a proof of concept, they implemented a small detection system that use one of these profiles to detect a large set of buffer-overflow attacks.
To analyse file access and process execution, they has a log of system activity, they already had a large database of system call traces, collected for the project using software developed for Seer. The traces were collected from ten machines with twenty users over two years. Their approach for analysing file access was to develop patterns for two models: user-oriented and process oriented. When analysing patterns for each user, the authors decided to categorize the users into two sets: system users and normal users.
At the end of the result, the authors where able to design a system that detects insider misbehaviour, monitor system call activity and watch for danger signs or unusual behaviour. The authors describe an experimental system designed to test this approach. They tested the system’s ability to detect common insider misbehaviour by examining file system and process-related system calls management