RE: Tracking a (potential) abuser?

From: Chris DeVoney <chris_devoney(at)cybercritic.com>
Date: Fri Feb 07 2003 - 10:39:47 EST

One other suggestion: write a Perl script to look for the time of activities that are out-of-sync with the related person's activities. For example, accounts created after normal tech support hours or activity on an 8-to-5 employees account outside of their normal work hours.

It takes a little bit to gather the time-band data for accounts but, if it involves students, lots of "abnormal" activity happens during the evening-night.

cdv

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Sat Feb 8 18:16:31 2003