a risk management approach to the " insider threat " .
A prototype real-time intrusion-detection expert system