FABS: file and block surveillance system for determining anomalous disk accesses
Detecting insider threats by monitoring system call activity