1. Field of the Invention
The present invention relates to a system for detecting misuse of a digital data gathering system by an authorized user.
2. Discussion of the Related Art
As used herein, misuse is defined as use of a digital data gathering system by an authorized user which is permitted by the system but which is uncharacteristic, violates an internal security policy, or is otherwise out of the bounds of the intended use of the system.
Misuse will be distinguished from intrusion, which is prohibited behavior such as the deliberate attempt to disrupt system operations or gain access to system areas which are prohibited from access by the user. These intrusions are generally performed by people who are unauthorized, or outside of an organization, and wish to remain unidentified. The results of intrusions may be catastrophic and therefore a great deal of development has been done in the intrusion detection and prevention area.
There are two types of digital data gathering commonly in use. One, information retrieval, is concerned with the retrieval of information from unstructured data sources, such as text documents, where each element of the data is not individually defined. The user enters search terms as a data query and the unstructured data are searched for occurrence of these terms. Results of such a search may return the text, i.e., the data, a summarization, interpretation, or modification of the data or may, e.g., in a World Wide Web search, only return the location, or site, of the data. The searching of unstructured data may be wide ranging, and the potential areas of use, or types of users, may be hard to categorize so that permitted access by the user to the information retrieval system should not be unnecessarily restricted.
The second type of digital data gathering commonly in use is the structured data source search, where structured data, generally held to be identifiably correct, within one specific data source, usually privately owned and accessed, are searched to return a specific answer. Typically, the structured database uses, and users, will be easier to categorize than those of an information retrieval system.
What is needed in the art is a system whereby misuse, or potential misuse, of the digital data gathering system by authorized users, or authorized user terminals, may be flagged and if necessary, reported, without undue interference or restriction to the user or system. Such misuse detection should be reliable, unobtrusive and should not require a large amount of processing overhead when possible.