[Cohen95-3] F. Cohen, A Note on Detecting Tampering with Audit Trails, IFIP-TC11, `Computers and Security' (submitted 1995) [This paper describes techniques for comparing audit trails from different sources in order to detect inconsistencies reminiscent of tampering. It demonstrates some simple analytical techniques and describes limitations.]