Machine-independent audit trail analysis – a decision support tool for continuous audit assurance
Peter J. Best, George Mohay, Alison M. Anderson · 2004
This paper reports the results of a research project which examines the feasibility of developing a machine-independent audit trail analyser (MIATA). MIATA is a knowledge based system which performs intelligent analysis of operating system audit trails. Such a system is proposed as a decision support tool for auditors when assessing the risk of unauthorised user activity in multi-user computer systems. It is also relevant to the provision of a continuous assurance service to clients by internal and external auditors. Monitoring user activity in system audit trails manually is impractical because of the vast quantity of events recorded in those audit trails. However, if done manually, an expert security auditor would be needed to look for 2 main types of events- user activity rejected by the system's security settings (failed actions) and user's behaving abnormally (e.g. unexpected changes in activity such as the purchasing clerk attempting to modify payroll data). A knowledge based system is suited to applications that require expertise to perform well-defined, yet complex, monitoring activities (e.g. controlling nuclear reactors and detecting intrusions in computer systems). To permit machine-independent intelligent audit trail analysis, an anomaly-detection approach is