Transaction mining for fraud detection in ERP Systems

Despite all attempts to prevent fraud, it continues to be a major threat to industry and government. Traditionally, organizations have focused on fraud prevention rather than detection, to combat fraud. In this paper we present a role mining inspired approach to represent user behaviour in Enterprise Resource Planning (ERP) systems, primarily aimed at detecting opportunities to commit fraud or potentially suspicious activities. We have adapted an approach which uses set theory to create transaction profiles based on analysis of user activity records. Based on these transaction profiles, we propose a set of (1) anomaly types to detect potentially suspicious user behaviour, and (2) scenarios to identify inadequate segregation of duties in an ERP environment. In addition, we present two algorithms to construct a directed acyclic graph to represent relationships between transaction profiles. Experiments were conducted using a real dataset obtained from a teaching environment and a demonstration dataset, both using SAP R/3, presently the predominant ERP system. The results of this empirical research demonstrate the effectiveness of the proposed approach.

Fraud detection in ERP systems using scenario matching

ERP systems generally implement controls to prevent certain common kinds of fraud. In addition however, there is an imperative need for detection of more sophisticated patterns of fraudulent activity as evidenced by the legal requirement for company audits and the common incidence of fraud. This paper describes the design and implementation of a framework for detecting patterns of fraudulent activity in ERP systems. We include the description of six fraud scenarios and the process of specifying and detecting the occurrence of those scenarios in ERP user log data using the prototype software which we have developed. The test results for detecting these scenarios in log data have been verified and confirm the success of our approach which can be generalized to ERP systems in general.

Dealing with temporal inconsistency in automated computer forensic profiling

Computer profiling is the automated forensic examination of a computer system in order to provide a human investigator with a characterisation of the activities that have taken place on that system. As part of this process, the logical components of the computer system – components such as users, files and applications - are enumerated and the relationships between them discovered and reported. This information is enriched with traces of historical activity drawn from system logs and from evidence of events found in the computer file system. A potential problem with the use of such information is that some of it may be inconsistent and contradictory thus compromising its value. This work examines the impact of temporal inconsistency in such information and discusses two types of temporal inconsistency that may arise – inconsistency arising out of the normal errant behaviour of a computer system, and inconsistency arising out of deliberate tampering by a suspect – and techniques for dealing with inconsistencies of the latter kind. We examine the impact of deliberate tampering through experiments conducted with prototype computer profiling software. Based on the results of these experiments, we discuss techniques which can be employed in computer profiling to deal with such temporal inconsistencies.

A framework for improved adolescent and child safety in MMOs

This paper presents an approach to providing better safety for adolescents playing online games. We highlight an emerging paedophile presence in online games and offer a general framework for the design of monitoring and alerting tools. Our method is to monitor and detect relationships forming with a child in online games, and alert if the relationship indicates an offline meeting with the child has been arranged or has the potential to occur. A prototype implementation with demonstrative components of the framework has been created and is introduced. The prototype demonstration and evaluation uses a teen rated online relationship-building environment for its case study, specifically the predominant Massive Multiplayer Online Game (MMO) World of Warcraft.

A distributed denial of service testbed

The Denial of Service Testing Framework (dosTF) being developed as part of the joint India-Australia research project for ‘Protecting Critical Infrastructure from Denial of Service Attacks’ allows for the construction, monitoring and management of emulated Distributed Denial of Service attacks using modest hardware resources. The purpose of the testbed is to study the effectiveness of different DDoS mitigation strategies and to allow for the testing of defense appliances. Experiments are saved and edited in XML as abstract descriptions of an attack/defense strategy that is only mapped to real resources at run-time. It also provides a web-application portal interface that can start, stop and monitor an attack remotely. Rather than monitoring a service under attack indirectly, by observing traffic and general system parameters, monitoring of the target application is performed directly in real time via a customised SNMP agent.

Oxford Companion to Australian Gardens [contributions: entries S-V]

Shelton, Edward Mason; p.548 Sherwood Arboretum; p.550 Soutter, William; pp.563-564 Styles or gardens and designed landscapes; pp.575-576 Summer-house; pp.579-580 Trapnell, Walter George; p.602 Tropical Gardens; pp.604-605 Wickham Park; p.642 Wijaya, Made; p.642 Williams, George; p.644 Williams, Keith A.W.; p.644 Verandah Garadening; p.614

Anna Clark (2008) History’s Children: History Wars in the Classroom. UNSW Press, Sydney, 178 pages

“History’s Children” stems from Anna Clark’s 2004 postdoctoral research into the ways in which Australian students connect with the past, and aims at bringing some classroom perspectives into the public debates about Australian history education. Although the title makes reference to the “History Wars”, there is little evidence of contestation, engagement, passion or intellectual excitement in Clark’s conclusions about what happens in history classrooms. Rather, Clark’s small focus groups with 182 high school students in 34 high schools around Australia indicate that “it got a bit dismal hearing student after student being so dismissive of Australian history” (p. 143). Apart from some enthusiasm for the study of Australians at war, a sort of resigned boredom seems to characterise what students have to say about learning Australian history, despite their acknowledgement that it is important to “know about” it.

Detection of anomalies from user profiles generated from system logs

We describe research into the identification of anomalous events and event patterns as manifested in computer system logs. Prototype software has been developed with a capability that identifies anomalous events based on usage patterns or user profiles, and alerts administrators when such events are identified. To reduce the number of false positive alerts we have investigated the use of different user profile training techniques and introduce the use of abstractions to group together applications which are related. Our results suggest that the number of false alerts that are generated is significantly reduced when a growing time window is used for user profile training and when abstraction into groups of applications is used.

Detecting collusive fraud in enterprise resource planning systems

In today's technological age, fraud has become more complicated, and increasingly more difficult to detect, especially when it is collusive in nature. Different fraud surveys showed that the median loss from collusive fraud is much greater than fraud perpetrated by a single person. Despite its prevalence and potentially devastating effects, collusion is commonly overlooked as an organizational risk. Internal auditors often fail to proactively consider collusion in their fraud assessment and detection efforts. In this paper, we consider fraud scenarios with collusion. We present six potentially collusive fraudulent behaviors and show their detection process in an ERP system. We have enhanced our fraud detection framework to utilize aggregation of different sources of logs in order to detect communication and have further enhanced it to render it system-agnostic thus achieving portability and making it generally applicable to all ERP systems.

Encyclopedia contributions : entries S-Z in Oxford Companion to Australian Gardens

Shelton, E.M. (p.548); Sherwood Arboretum (p.550); Soutter, William (pp.563-4); Styles (pp.575-6); Summer-House (579-580); Trapnell, W.G. (p.602); Tropical Gardens (pp.604-5);Verandah Gardening (p.614); Wickham Park (p.642); Wijaya, Made (p.642); Williams, George (p.644); Williams Keith A (p.644).

CAT Detect (Computer Activity Timeline Detection) : a tool for detecting inconsistency in computer activity timelines

The construction of timelines of computer activity is a part of many digital investigations. These timelines of events are composed of traces of historical activity drawn from system logs and potentially from evidence of events found in the computer file system. A potential problem with the use of such information is that some of it may be inconsistent and contradictory thus compromising its value. This work introduces a software tool (CAT Detect) for the detection of inconsistency within timelines of computer activity. We examine the impact of deliberate tampering through experiments conducted with our prototype software tool. Based on the results of these experiments, we discuss techniques which can be employed to deal with such temporal inconsistencies.

Judge George W Paul's Japanese house : a case study

In the late 1880s a pre-fabricated Japanese house was shipped from Kobe, Japan, to Brisbane, Australia, and erected in the up-market suburb of New Farm by Japanese tradesmen. This paper is developed from a broader project researching the life of G W Paul, the man who had the house built and subsequently lived in it for the remainder of his life. Paul’s motivation in importing the house represented a unique, but unfulfilled effort to develop a future, hybrid culture for Queensland. This effort took the form of a commercial venture to construct Japanese houses as desirable and climatically suitable dwellings. Against the backdrop of this ambition, this paper presents new research to elucidate and extend previous knowledge, assesses the reception of the house by its nineteenth century Brisbane audience, and considers possible reasons for the limited response which signalled the cancellation of the commercial venture.