fupids2 is a so-called human oriented IDS based on
the FUPIDS project. fupids2 calculates an attacker
level for every user on all Unix/Linux/BSD systems
in the network. It looks at the behavior of the
user (the programs the user uses, the daytime the
user is active, the building and room the user
uses, the part of the room in which the user sits,
and so on) and reports if the user engages in
behavior that is unusual for that person. This
method can often detect accounts overtaken by
attackers.
