journaled entries that provide details of who logged onto the system, when, and what they accessed.
records that detail who logged on to the system, when they did, and what info or resources they used. valuable tool to deetect, prevent, and monitor access to a system.
-based on proportions or probabilities for discrete distributions -based on density for continuous distributions  (probability= area under density curve)