The backup copies need to be stored on removable data storage. If the copies aren't stored on a removable data store then a hacker could modify both the current and backup copy of a file and the report will never list any changes. An intrusion detection tool will actively monitor system programs in order to detect changes to possibly a system program. Once detected an alert would be sent to the administrator detailing the intrusion. Track anomalies, i.e. changes to the typically work pattern of the computer systems.
Network intrusion is a common misuse of computer systems.
An intrusion detection system would monitor current activity of the system and compare it against the normal activity of the system. The super-user accounts for UNIX and NT can be monitored and the activities taken by users of the accounts can be logged. The activities could be matched against policies for the accounts. Track previously known misuses. Detection is often a reactive process.