Patent ID: 6996844

Claim:
A method for detecting possible security violations and issues in a computer system related to user ID substituting and switching, said computer system having a log of user ID substitutions and switches, said method comprising the steps of: providing a set of rules in a computer-readable alarm conditions file, said rules defining conditions of user ID substitutions and switches which are to be considered possible security issues, at least one of which rules is a rule besides a rule defining a number of failed user switches in a specified time period beginning at a first failed attempt, wherein said number is greater than 1; providing a process adapted to access said alarm conditions file, and to evaluate said log of user ID substitutions and switches according to said set of rules; evaluating said log of user ID substitutions and switches to find any entries in said log which meet one or more defined conditions in said set of rules; and outputting an alert responsive to finding one or more log entries which meet said conditions.