System and method for detecting fraud and misuse of protected data by an authorized user using event logs

1. A method of detecting improper access of protected data by an authorized user, the method comprising:

extracting event data from an event log file including information associated with an attempt to access protected data, the extracting being performed by a computer system configured to recognize and parse the event data within the event log file for each of a plurality of different file formats to enable a monitoring system implemented by a processor to oversee authorized user activity across a plurality of applications across one or more computer environments for determining the attempt to access the protected data is fraudulent or indicative of probable misuse, wherein the authorized user has a plurality of different associated user identifiers;

normalizing the event data based on a predefined format;

processing the normalized event data to determine at least one of the plurality of different associated authorized user identifiers is linked to the attempt to access the protected data;

processing the normalized event data and the at least one of the plurality of different associated authorized user identifiers to determine whether the attempt to access the protected data is fraudulent or indicative of probable misuse based on at least one rule applied by the monitoring system, the rule comprising at least one criterion related to accesses in excess of a specific volume, accesses during a pre-determined time interval, or accesses by a specific authorized user;

storing normalized event data that is incapable of being associated with a known user in a list separate from normalized event data having the at least one of the plurality of different associated authorized user identifiers;

generating a notification, based on a determination that the attempt to access the protected data is fraudulent or indicative of probable misuse; and

generating additional data for the rule associated with the event data based on the notification,

wherein the monitoring system continuously processes the normalized event data according to a predefined schedule, and the event log file corresponds with an application of the plurality of applications accessible by the authorized user, each application of the plurality of applications has a corresponding event log file, and the event log file of each application of the plurality of applications has a file format of the plurality of different file formats.

2. The method of claim 1 , wherein the monitoring system initiates preventive action responsive to the generated notification.

3. The method of claim 2 , wherein the preventive action comprises suspending access of the specific user.

4. The method of claim 1 , wherein the predefined format comprises an extensible markup language (XML) format.

5. The method of claim 1 , further comprising causing one or more of an alert based on the notification to be output to a display communicatively coupled with the monitoring system or to an electronic device communicatively coupled with the monitoring system.

6. The method of claim 1 , further comprising:

obtaining role information of the authorized user,

wherein the at least one rule applied by the monitoring system is based on a user's specific role.

7. The method of claim 1 , wherein the specific user is a sales person and the at least one rule applied by the monitoring system of accesses by the specific user comprises the specific user accessing information of clients unrelated to clients of the specific user.

8. The method of claim 1 , wherein the rule comprises at least one criterion related to accesses in excess of a specific volume and accesses during a pre-determined time interval.

9. An apparatus comprising:

a processor; and

at least one memory including computer program code for one or more programs, the at least one memory and the computer program code configured to, with the processor, cause the apparatus to:

extract event data from an event log file including information associated with an attempt to access protected data, the apparatus being configured to recognize and parse the event data within the event log file for each of a plurality of different file formats to enable a monitoring system implemented by the processor to oversee authorized user activity across a plurality of applications across one or more computer environments for determining the attempt to access the protected data is fraudulent or indicative of probable misuse;

normalize the event data based on a predefined format;

process the normalized event data to determine an identifier linked with the attempt to access the protected data, the identifier being one of a plurality of different identifiers indicative of one or more of an authorized user of a system associated with the protected data, a device used to attempt to access the protected data, an authorized user of the device used to attempt to access the protected data, a location of the device used to attempt to access the protected data, or a time of the attempt to access the protected data;

process the normalized event data and the identifier to determine whether the attempt to access the protected data is fraudulent or indicative of probable misuse based on at least one rule applied by the monitoring system, the rule comprising at least one criterion related to accesses in excess of a specific volume, accesses during a pre-determined time interval, or accesses by a specific authorized user;

store normalized event data that is incapable of being associated with a known identifier in a list separate from normalized event data having the identifier;

generate a notification based on a determination that the attempt to access the protected data is fraudulent or indicative of probable misuse; and

generate additional data for the rule associated with the event data based on the notification,

wherein

the monitoring system is configured to continuously process the normalized event data according to a predefined schedule, and

the event log file corresponds with an application of the plurality of applications accessible by the authorized user, each application of the plurality of applications has a corresponding event log file, and the event log file of each application of the plurality of applications has a file format of the plurality of different file formats.

10. The method of claim 9 , wherein the monitoring system is configured to initiate preventive action responsive to the generated notification.

11. The method of claim 10 , wherein the preventive action comprises suspending access of the specific user.

12. The method of claim 9 , wherein the predefined format comprises an extensible markup language (XML) format.

13. The method of claim 9 , wherein the monitoring system is further configured to cause one or more of an alert based on the notification to be output to a display communicatively coupled with the monitoring system or to an electronic device communicatively coupled with the monitoring system.

14. The method of claim 9 , wherein the computer program code is further configured to:

obtain role information of the authorized user,

wherein the at least one rule applied by the monitoring system is based on a user's specific role.

15. The method of claim 9 , wherein the specific user is a sales person and the at least one rule applied by the monitoring system of accesses by the specific user comprises the specific user accessing information of clients unrelated to clients of the specific user.

16. The method of claim 9 , wherein the rule comprises at least one criterion related to accesses in excess of a specific volume and accesses during a pre-determined time interval.

17. A non-transitory computer-readable storage medium carrying computer-readable instructions which, when executed by a processor, cause an apparatus to:

extract event data from an event log file including information associated with an attempt to access protected data, the apparatus being configured to recognize and parse the event data within the event log file for each of a plurality of different file formats to enable a monitoring system implemented by the processor to oversee authorized user activity across a plurality of applications across one or more computer environments for determining the attempt to access the protected data is fraudulent or indicative of probable misuse;

normalize the event data based on a predefined format;

process the normalized event data to determine an identifier linked with the attempt to access the protected data, the identifier being one of a plurality of different identifiers indicative of one or more of an authorized user of a system associated with the protected data, a device used to attempt to access the protected data, an authorized user of the device used to attempt to access the protected data, a location of the device used to attempt to access the protected data, or a time of the attempt to access the protected data;

process the normalized event data and the identifier to determine whether the attempt to access the protected data is fraudulent or indicative of probable misuse based on at least one rule applied by the monitoring system, the rule comprising at least one criterion related to accesses in excess of a specific volume, accesses during a pre-determined time interval, or accesses by a specific authorized user;

store normalized event data that is incapable of being associated with a known identifier in a list separate from normalized event data having the identifier;

generate a notification based on a determination that the attempt to access the protected data is fraudulent or indicative of probable misuse; and

generate additional data for the rule associated with the event data based on the notification,

wherein

the monitoring system is configured to continuously process the normalized event data according to a predefined schedule, and

the event log file corresponds with an application of the plurality of applications accessible by the authorized user, each application of the plurality of applications has a corresponding event log file, and the event log file of each application of the plurality of applications has a file format of the plurality of different file formats.

18. The method of claim 17 , wherein the monitoring system is configured to initiate preventive action responsive to the generated notification.

19. The method of claim 17 , wherein the monitoring system is further configured to cause one or more of an alert based on the notification to be output to a display communicatively coupled with the monitoring system or to an electronic device communicatively coupled with the monitoring system.

20. The method of claim 17 , wherein the specific user is a sales person and the at least one rule applied by the monitoring system of accesses by the specific user comprises the specific user accessing information of clients unrelated to clients of the specific user.