A Study of Effectiveness in Masquerade Detection

Bhukya, Wilson Naik; Kumar, G. Suresh; Negi, Atul

doi:10.1109/tencon.2006.344199

Cited by 5 publications

(4 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Within the results of other researchers, the hit rate HR (Coull et al 2003;Coull and Szymanski 2008) or detection ratio DR (Bhukya et al 2006;Wang et al 2004) can be found, which are the opposite of defined FAR:…”

Section: Results Obtainedmentioning

confidence: 62%

“…Paper Bhukya et al (2006) presents an approach to intrusion detection based on Hidden Markov Model (HMM) with emission symbol semantics for system calls. The authors stated that the HMM is a well-known probabilistic method to model the sequences of information and an optimal modeling technique to minimize false positive rate while maximizing detection rate.…”

Section: Related Methodsmentioning

confidence: 99%

“…14 (Bhukya et al 2006). Unfortunately, the solution and examination process in particular are not precisely described in the short paper.…”

Section: Comparison With Other Methodsmentioning

confidence: 99%

“…Unfortunately, the solution and examination process in particular are not precisely described in the short paper. The authors provide only one result (HR and FRR) giving the best score concerning the effectiveness ratio (Bhukya et al 2006). In contrast to the MTS ratio, the effectiveness ratio used to obtain the results in Bhukya et al (2006) strongly promotes the HR ratio (0.8 · HR + 0.2 · FRR).…”

Section: Comparison With Other Methodsmentioning

confidence: 99%

See 3 more Smart Citations

Fuzzy approach for intrusion detection based on user’s commands

2015

View full text Add to dashboard Cite

The article concerns the problem of detecting masqueraders in computer systems. A masquerader in a computer system is an intruder who pretends to be a legitimate user in order to gain access to protected resources. The article presents an intrusion detection method based on a fuzzy approach. Two types of user's activity profiles are proposed along with the corresponding data structures. The solution analyzes the activity of the computer user in a relatively short period of time, building a user's profile. The profile is based on the most recent activity of the user, therefore, it is named the local profile. Further analysis involves creating a more general structure based on a defined number of local profiles of one user, called the fuzzy profile. It represents a generalized behavior of the computer system user. The fuzzy profiles are used directly to detect abnormalities in users' behavior, and thus possible intrusions. The proposed solution is prepared to be able to create user's profiles based on any countable features derived from user's actions in computer system (i.e., used commands, mouse and keyboard data, requested network resources). The presented method was tested using one of the commonly available standard intrusion data sets containing command names executed by users of a Unix system. Therefore, the obtained results can be compared with other approaches. The results of the experiments Communicated by V. Loia. have shown that the method presented in this article is comparable with the best intrusion detection methods, tested with the same data set, in the matter of the obtained results. The proposed solution is characterized by a very low computational complexity, which has been confirmed by experimental results.

show abstract