Online masquerade detection resistant to mimicry

摘要: A framework for online detection of masquerade attacks is proposed.At the analysis stage, local alignment algorithms are introduced.At verification a validation scheme based on U-test implemented.For mimicry recognition, parallel monitored actions performed.For evaluating approach, SEA dataset applied. Masquerade attackers internal intruders acting through impersonating legitimate users victim system. Most proposals their suggested recognition methods comparison use models protected environment. However recent studies have shown vulnerability against adversarial imitating behavior users. In order to contribute identification, this article introduces novel method robust evasion strategies mimicry. The proposal described two levels information processing: and verification. At implemented. way it possible score similarity between action sequences performed by users, bearing in mind regions greatest resemblance. On other hand, statistical non-parametric Through refine labeling avoid making hasty decisions when nature not sufficiently clear. strengthen effectiveness attacks, concurrency. This involves partitioning long with purposes: subsequences small intrusions more visible analyzing new suspicious situations occur, such as execution never before seen commands or discovery potentially harmful activities. has been evaluated from functional standard attacks. Promising experimental results shown, demonstrating great precision conventional masqueraders (TPR=98.3%, FPR=0.77%) success rate 80.2% identifying hence outperforming best contributions bibliography.