 [10] is a new tool for monitoring behavior over time in data mining situations. This tool particularly detects individual accounts that begin to behave in a way different from accounts to which they have previously been similar to. Each account is selected as a target account and is compared with all other accounts in the database, using either external comparison or internal criteria summarizing earlier behavior patterns of each account. Based on this comparison, a peer group of accounts most similar to the target account is chosen. The behavior of the peer group is then summarized at each subsequent time point, and the behavior of the target account is compared with the summary of its peer group. The targeted accounts showing a behavior different from their peer group summary behavior are flagged as suspicious. This technique might suffer from the fact that defining adequate metrics to measure the correlation between different accounts is very difficult or even impossible, thus the false alarm rate could be very high. Break point analysis [11] is a tool that identifies changes in spending behav- ior based on the transaction information in a single account. Recent transac- tions are compared with previous spending behavior to detect features such as rapid spending and an increase in the level of spending, features that would not necessarily be captured by other detection. This technique, if it is used alone, might also suffer from false alarms. The basic idea of activity profiling [12,13] is that the past behavior of a user or a standard operation such as logins, program execution, etc is accu- mulated in order to construct a pattern of the expected behavior of this user or application. The profile serves as a signature/description of normal activ- ity for its respective subject. The observed behaviors are in general charac- terized in terms of metrics (which might be some statistical variables) and models. A metric is a variable reflecting both user activities and resource usage, obtained through observations.