I am working on profiling users based on their use of certain commands. Unix1 indicates use of commands such as mv, cp. Unix2 indicates use of commands such as awk, find.
Mail indicates use of any mailing tools.
News indicates use of any news group readers. Ed indicates use of the editors vi or emacs. Int indicates use of internet commands such as telnet, ftp, etc. HAR and BAD look for specific attack signature related commands. I also realize that most system administrators do not have these tools.