Anomaly Detection over User Profiles for Intrusion Detection

摘要: Intrusion detection systems (IDS) have often been used to analyse network traffic help administrators quickly identify and respond intrusions. These generally operate over the entire network, identifying “anomalies” atypical of network’s normal collective user activities. We show that anomaly could also be host-based so usage patterns an individual profiled. This enables masquerading intruders by comparing a learned profile against current session’s profile. A prototype behavioural IDS applies concept behaviour compares effects using multiple characteristics users. Behaviour captured within system consists application usage, performance (CPU memory), websites visits, number windows has open, their typing habits. The results such is entirely feasible, physically related are more relevant profiling combination can significantly decrease time taken detect intruder.