Abstract: Methods and apparatus determine a set of transactions that may be assigned to a grouping within a computer system or application. The set of transactions may be analyzed and assigned on the basis of statistical analysis of the actual usage versus current authorizations. In addition, the set of transactions may be analyzed for policy conflicts. The assignment of transactions to groupings may further be determined according to the presence of policy conflicts. Additionally, groupings may be assigned to users based on organizational characteristics such as membership in a company, division, department, business unit, or vocation.

Abstract: Disclosed is a method and apparatus to develop user behavioral profiles of specific transaction access patterns for authorized users within computer application software, operating systems, network operating systems and firewall systems, and to monitor the on-going activity of the subject user to detect unusual transaction activity. The method and apparatus may be used for early detection of “trusted users” that deviate from their normal and routine access of files and transactions supported by the specific application. Alert messages are then issued. The apparatus may then allow application administrators to determine if the activity should be authorized, and allow for this specific transaction activity to impact the profile so further alerts are avoided.