Outlier detection in audit logs for application systems

•Evaluate a single algorithm is not effective for the generalization of the problem that the detection means fields considered outliers.•Combined different algorithms to optimize the detection of outliers are evaluated.•Designed a processes that combine Data Mining algorithms to detect outliers fields.•The convenience of applying hybrid methods in the detection of outliers is evaluated.

An outlier is defined as an observation that is significantly different from the other data in its set. An auditor will employ many techniques, processes and tools to identify these entries, and data mining is one such medium through which the auditor can analyze information. The enormous amount of information contained within transactional processing systems׳ logs means that auditors must employ automated systems for anomalous data detection. Several data mining algorithms have been tested, especially those that deal specifically with classification and outlier detection. A group of these previously described algorithms was selected for use in designing and developing a process to assist the auditor in anomalous data detection within audit logs. We have been successful in creating and ratifying an outlier detection process that works in the alphanumeric fields of the audit logs from an information system, thus constituting a useful tool for system auditors performing data analysis tasks.