TABLE OF CONTENT

COVER PAGE

APPROVAL PAGE

DEDICATION

ACKNOWLEDGEMENT

TABLE OF CONTENT

• BACKGROUND OF STUDY
• STATEMENT OF PROBLEM
• OBJECTIVES OF STUDY
• SIGNIFICANCE OF STUDY
• SCOPES OF THE STUDY
• LIMITATIONS OF THE STUDY
• DEFINITION OF TERMS

CHAPTER TWO

• COMPUTER NETWORK
• MEDIUM USED TO TRANSPORT DATA
• PROTOCOLS
• TOPOLOGY
• ROLES AND RESPONSIBILITIES OF COMPUTER NETWORK
• GEOGRAPHICAL AREA
• NETWORK MONITORING SYSTEM
• ACTIVITY LOG
• FILE ACTIVITY MONITORING

2.9       DETECTING INSIDER THREATS BY MONITORING SYSTEM CALL ACTIVITY

CHAPTER THREE

METHODOLOGY

• INTRODUCTION
• METHODS OF DATA COLLECTION
• ANALYSIS OF THE EXISTING SYSTEM
• ANALYSIS OF THE PROPOSED SYSTEM
• METHODOLOGY

CHAPTER FOUR

• OVERVIEW OF THE DESIGN
• MAIN MENUOF   THE   NETWORK   ACTIVITY   MONITORING SYSTEM.

4.4 CHOICE AND JUSTIFICATION OF PROGRAMING LANGUAGE

4.5 SYSTEM REQUIRMENT

4.6 IMPLEMENTATION PLANS

4.7 MAINTENANCE DETAILS

CHAPTER FIVE

5.1     SUMMARY

5.2     REVIEW OF ACHIEVEMENTS

5.3 SUGESTIONS FOR FURTHER STUDIES

5.4 AREAS OF APPLICATION

5.5 CONCLUSION

CHAPTER ONE

INTRODUCTION

Attacks on computer by outside intruder are more publicized but the ones perpetrated by insiders are very common and often more damaging. Insiders represent the greatest threat to computer security because they understand their organization’s business and how their computer systems work. They have both the confidentiality and access to perform these attacks. An inside attack will have a higher probability of successfully breaking into the system and extracting critical information. The insiders also represent the greatest challenge to securing the company network because they have authorized level of access to the file system.

In a quest for maximum profitability in a network, there is need to monitor the activities performed such that the network activity in a real time would be tracked, confidential information safeguarded and control over the daily activities of every staff established. The question is: which and how would one develop the so much needed system that would exhibit all these potentialities?

Network activity monitoring system is used to detect inside threats by monitoring file access and process activity (Behr et al, 2009). It is a powerful tool that allows one to track any local area network, giving you the most detailed information on when, how and what your network users do on daily basis. If it is a library public network, university or commercial organization network, Activity Monitor offers efficient control. This work targets the monitoring of every activity of a user in a computer network and maximizes the security for the organization or corporate body.

• BACKGROUND OF STUDY

The Federal Inland Revenue service (FIRS) is one of the federal ministries charged with the responsibility of accessing, collecting, and accounting for the various taxes to the federal government since 1943.

Tax revenue has been reliable from time, from where government rely for decision making, and aids for development and administrative planning, hence the need for optimum human resource of the organisation or ministry; for it’s considered to be their most valuable asset if properly harnessed and are well motivated to perform their assigned tasks so as to enhance the organisations goals and objectives.

Computer network activity monitoring system has become one of the vital tools in providing evidence in cases such as computer misuse and fraud. Computers and other devices are being used increasingly to commit, enable or support unwanted activity perpetrated against individuals, organizations or assets. Although it is most often associated with the investigation of a wide variety of computer crime, network activity monitoring system may also be used in civil proceedings. The discipline involves similar techniques and principles to data recoveryand a lot of information is retained on the computer than most people realize. It’s also more difficult to completely remove information than it is generally thought. For these reasons (and many more), network activity monitoring system can often find evidence or even completely recover lost or deleted information, even if the information was intentionally deleted.

This system consist of two tier application – server and client whereby the activity monitoring server can be installed in any computer in the entire local area network and the client which is the remote spy software is installed on all the computers on the network to be monitored.

• STATEMENT OF PROBLEM

The existing system used by FIRS has been a challenge to them. Amongst the problems affecting the FIRS from maintaining a steady reliable accounting figures and estimates are:-

With the current system, staffs easily erase or add data in order to cover up their fraud since there is no back up of the activity log. Frauds like computer fraud: – loss or damage to money, securities resulting directly from the use of any computer to fraudulently cause a transfer of money or other property from inside the premises to a personat a place outside the premise.

Their method of operation is not so efficient for both units in the department (Operations and Reconciliation units).Both units cannot work at the same time, and this is because the staffs in one of the unit (reconciliation unit) has to wait for the staffs in the other unit (operation unit) to get their work to some extent before they can process their own work, and while they are processing their own work, the staffs in the operation unit has to pause their work a little,and with this manual of operation in the department, rooms for corporate fraud is being created.

These are the more reasons, why the researcher embarked on this research.

• OBJECTIVES OF STUDY

This project targets towards discovering what should be done to improve the existing system, monitoring the daily activities of every user in a network and using it to provide evidence to frauds or crimes committed using computer technology which some people referred to as digital crime; that is crime committed using a computer system.

The objective of this work is to develop a system that should be able to;

1. Monitor the daily activities of every user in a network in real time.
2. Detect active users.
3. Provide accurate evidence on corporate fraud when investigation is being carried out in an organization.
4. Has a good memory management for efficient carrying out of activities.

• SIGNIFICANCE OF STUDY

This work was embarked upon for several reasons discussed below and again provides answers to some questions like:

What is the value in adopting an investigation system?

Why should you invest time and money on this?

What are the benefits to organisations?

Therefore some of the significance and benefits of this work include:

Increased employers loyalty: -What ultimately creates the employers loyalty is meeting and exceeding their expectation.

Maintaining system integrity.

Staying current on work status so as to know how well the organisation is going.

Ensure proper handling of investigation in computing:This is the reason why we need a careful, methodical process for gathering digital data in the first place; and this is why we need network activity monitoring system.

Increased employer’s retention:-The employees are an investment. Generally, it takes nine to twelve months or longer before an employee is a productive asset to a company. If an employee leaves after a year or two, the company has lost most of its investment. Information empowered decision making: –Most managers, executives and employers make decisions based upon all relevant information. There are some actions that can have a profound effect on corporate decision making; those actions are more easily justifiable when you have easily accessed the users system.

• SCOPES OF THE STUDY

Although a network activity monitoring system involves many things and activities that can be run within it, yet due to lack of time and space, we were not able to use this software in other operating systems apart from windows operating system (that is from windows XP to windows operating system of higher versions). Furthermore this work did also not involve internet connectivity as well as detection of virus in a network.

• LIMITATIONS OF THE STUDY

During the course of this study, many things militated against its completion, some of which are;

Lack of finance

Refusal of the Federal Inland Revenue Services Awka, to give detailed answers and in some cases no answer at all to some questions.

This project is limited to all the data associated with the information gotten from the Federal Inland Revenue Service commission, and due to time factor, not all the commissions were reached for sources of data and information.

• DEFINITION OF TERMS

 NAMS (Network activity monitoring system): This is the system that is used monitor the daily activity of every user on a network

 Corporate fraud: This is the fraud committed by insiders in a large, publicly traded (or private) corporation, and/or by senior executives.

 Real time: Occurring immediately, this is used for such task as navigation, in which the computer must react to a steady flow of new information without interruption.

 LAN (local area network): This is computer network that spans a relatively small area. Most LANs are confined to a single building or group of buildings.

 Suid: A file attributes which allows a program to run as a specific user no matter who executes it.

 Corporate decision making: This is connected with a corporation, this involves the image of a company or organization where all its members involve taking critical decision making (finance/planning/strategy)

 Internal Auditor: An employee of a company charged with providing independent and objective evaluations of the company’s financial and operational business activities, including its corporate governance. Internal auditors also provide evaluations of operational efficiencies and will usually report to the highest level of management on how to improve the overall structure and practices of the company

 External Auditor: An external auditor is an audit professional who performs an audit in accordance with specific laws or rules on financial statements of a company, government entity, other legal entity or organization, and who is independent of the entity being audited.

CHAPTER FIVE

SUMMARY AND CONCLUSION

4.1 SUMMARY

The topic of this work was reviewed in chapter one with the view of solving the problems encountered in the Ministry of Federal Inland Revenue Service, Anambra state. During the course of the research, the present system was analysed in other to detect the bottlenecks using Structured System Analysis and Design Methodology. Object oriented analysis and design methodology was found sufficient and efficient in the design of the proposed system.

4.2 REVIEW OF ACHIEVEMENTS

The activity monitoring system was tested and found to achieve the following:

It monitored the daily activities of the clients.

Has a great impact on memory management of the server.

Detected active users.

Provided accurate evidence on corporate fraud when investigation is being carried out in an organization with regards to date and time.

Captured and saved screen shots of every user’s daily activities.

5.3 SUGESTIONS FOR FURTHER STUDIES

The developed system can be integrated to monitor micro-programs that can run within the system without actually displaying on the computer screen, or another activity monitoring system that can make use of other means of monitoring the activities on the network apart from screen-capturing can be developed so as to enable monitoring not only the activities that can be displayed on the computer screen but also the ones that can run within the system without actually displaying it on the computer screen.

5.4 AREAS OF APPLICATION

The activity monitoring system can be applied in so many areas where there is need to monitor the clients in a network. Financial institution, private and public sector and so on can benefit from using the software, but with further enhancement it can be used in global organization like the internet service providers, bank etc.

5.5 CONCLUSION

Today, computing system which consists of a broad range of processors, communication network and information repositories are vital to the operations of many sectors in our society, from financial and manufacturing to education and health care.

Network activity monitoring system is a desktop based application, developed to assist organization and institution in monitoring the activities running in their network domain to decrease financial fraud, improve the staff productivity and improve confidentiality of data.

With activity monitoring system as a powerful tool for monitoring activities and hidden data in activity logs, all data and files can be capture and kept securely over the server without tipping of attackers.

The view of this work has shown that monitoring the activities on a network system is efficient because there may not be room for any lapses in delay time in identifying what might have probably gone wrong assuming a problem arises. However implementation of the proposed system will improve the company’s performance in relation to accessing the activity logs. With the necessity of information flow in a network, putting a monitoring mechanism (wired or wireless) in place will go a long way in checkmating hacker authentications into networks.