Masquerade Attack Detection Using a Search-Behavior Modeling Approach

摘要: Masquerade attacks are unfortunately a familiar security problem that is consequence of identity theft. Detecting masqueraders very hard. Prior work has focused on user command modeling to identify abnormal behavior indicative impersonation. This paper extends prior by presenting one-class Hellinger distance-based and SVM techniques use set novel features reveal intent. The specific objective model search profiles detect deviations indicating masquerade attack. We hypothesize each individual knows their own file system well enough in limited, targeted unique fashion order find information germane current task. Masqueraders, the other hand, will likely not know layout another user’s desktop, would more extensively broadly manner different than victim being impersonated. extend research uses UNIX sequences issued users as audit source relying upon an abstraction commands. devise taxonomies commands Windows applications used abstract actions. also gathered our normal masquerader data sets captured environment for evaluation. datasets publicly available researchers who wish study attack rather author identification much reported work. experimental results show reliably detects all with low false positive rate 0.1%, far better published results. limited huge performance gains over same larger features.