Abstract: Disclosed is a method and apparatus to develop user behavioral profiles of specific transaction access patterns for authorized users within computer application software, and to monitor the on-going activity of the subject user to detect unusual transaction activity. The method and apparatus may be used for early detection of “trusted users” that deviate from their normal and routine access of files and transactions supported by the specific application. Alert messages are then issued. The apparatus may then allow for the authorities in charge of the application to determine if the activity should be authorized, and allow for this specific transaction activity to impact the profile so further alerts are avoided. The method and software tools may include a transaction activity harvester, a transaction parser, an analytical profile builder, a client identity builder, a transaction identification builder of transactions within an application, and a monitoring and alert system.