Investigative Data Mining for Security and Criminal Detection

Mail sent to urge others to send massive amounts of e-mail to a single system or person, with the intent of crashing the recipient's system. Mailbombing is widely regarded as a serious offense.

Hardware, software, or firmware that is intentionally included in a system for an unauthorized purpose (e.g., a Trojan horse).

A random variable x representing a quantitative measure accumulated over a period.

Synonymous with impersonation, masquerading, or spoofing.

Detection of intrusions by looking for activity that corresponds to known intrusion techniques or system vulnerabilities. Also known as rules-based detection.

A computer program or process that mimics the legitimate behavior of a normal system feature (or other apparently useful function) but performs malicious activities once invoked by the user.

Audit data from multiple hosts may be used to detect intrusions.