A variable-length model for masquerade detection

Xiao, Xi; Tian, Xin; Zhai, Qibin; Xia, Shu-Tao

doi:10.1016/j.jss.2012.05.049

Cited by 8 publications

(21 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…• We extend the Markov chain-based variable-length model of Xiao et al [4] and integrate the new features into the model (see Sections II-B.5-II-B.7). • On three different datasets (SEA, PU Truncated, and Greenberg Truncated) with two data settings, our model outperforms the baselines (Xiao et al [4]) at several metrics, such as the true positive rate (TPR), false positive rate (FPR), receiver operator characteristic (ROC), and threshold variance. • Our model achieved significant improvement on the TPR metric compared to state-of-the-art Convolutional Neural Network CNN [13] for PU Truncated Full, Greenberg Truncated Full, and state-of-the-art sequence-alignment Hidden Markov Model SA-HMM [14] for SEA Full.…”

Section: A Contributionsmentioning

confidence: 99%

“…Although it achieved better detection results, it had several disadvantages, such as too many states, a high computational cost, poor fault tolerance, and poor generalization. To address these problems, Xiao et al [4] improved upon Tian et al's work [27] by significantly reducing the number of states, which decreased memory consumption and computation. Their model used weighted frequencies of variable-length sequences as a feature.…”

Section: ) Masquerade Detection Based On Anomaly Detectionmentioning

confidence: 99%

“…Elmasry et al [30] [4] model with 2 + 1 states. In Section IV, we verify empirically that integrating these features boosts our proposed model's detection performance compared to the baselines.…”

Section: ) Masquerade Detection Based On Anomaly Detectionmentioning

confidence: 99%

“…The main disadvantage of the misuse detection approach is the difficulty of adapting to dynamic changes in attacking behavior. If an attacker's strategy changes, then the detection approach needs to be updated [4]- [6]. In this study, therefore, we opted for the anomaly detection approach.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Model for Detection of Masquerade Attacks Based on Variable-Length Sequences

2020

View full text Add to dashboard Cite

A masquerader is an attacker who gains illegitimate access to a user's account. Masquerade detection is one of the key problems of intrusion detection systems. Deep learning models that obtained state-of-the-art results in masquerade detection have failed to exhibit very high detection performance when data samples contain limited information. Alternatively, computationally cheaper and more memoryefficient traditional machine learning models suffer from less robust features, which hinders them in achieving high detection performance. The contributions of this paper are as follows: we introduce new features of variable-length UNIX command sequences (i.e., weighted occurrence frequencies of different orders) and integrate these features into an extended Markov-chain-based variable-length model. The detection performance of our model is evaluated on three publicly available and free datasets: Schonlau (SEA), Purdue (PU), and Greenberg. The results demonstrate that our model significantly improves the true positive rate (TPR), false positive rate, receiver operator characteristic, and threshold variance compared to the baselines (other Markov-chain-based variable-length models). Furthermore, in terms of the TPR, the proposed method is superior to a state-of-the-art deep learning model that uses a convolutional neural network on the PU and Greenberg datasets and a state-of-the-art sequence-alignment-hidden Markov model on the SEA dataset. Moreover, the proposed method is much more lightweight than the state-of-the-art models in terms of computational and memory complexity, and thus more suitable for real-time masquerade detection.

show abstract

Section: A Contributionsmentioning

confidence: 99%

Section: ) Masquerade Detection Based On Anomaly Detectionmentioning

confidence: 99%

Section: ) Masquerade Detection Based On Anomaly Detectionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Model for Detection of Masquerade Attacks Based on Variable-Length Sequences

2020

View full text Add to dashboard Cite

show abstract

“…Because the Schonlau dataset does not include session times, they also generate a synthetic dataset in order to show the performance of profile HMM. A recent approach, based on Markov chain with states of variable length sequences, is proposed in [31]. Even though it produces better results by using less time and space than some fixed length approaches, it shows similar results with the naive Bayes approach with low false positive rates.…”

Section: S Senmentioning

confidence: 99%

Sequence‐based masquerade detection for different user groups

Şen

2014

Security Comm Networks

View full text Add to dashboard Cite

Insider threats are one of the biggest threats that organizations are confronted with today. A masquerader who impersonates another user for his malicious activities has been studied extensively in the literature. The approaches proposed on masquerade detection mainly assume that masquerader behavior will deviate from the typical behavior of the victim. This research presents a rigorous evaluation of sequence-based approaches based on this assumption. The main idea underlying sequence-based approaches is that users type similar commands, in a similar order, every time to do a specific job and, these similarities could distinguish users from others. Sequence-based approaches in the literature only consider commands typed in a specific order, at all times. In this research, we also take into account typing similar commands in a command sequence, but in an unordered way, in the newly proposed method, Matching of Unordered Command Sequences. We compare this new technique with another sequence-based approach called Matching of Ordered Command Sequences, and a command-based approach called Matching of Commands. These techniques are evaluated with varying parameters in order to explore how the order of commands, the variations in a command sequence, and the variety of commands affect masquerade detection. Furthermore, the performance of these methods on different types of users and masqueraders is analyzed. We explore what kind of users are easily distinguishable from others, and what kind of masqueraders are difficult to detect.

show abstract

A co‐occurrence matrix based masquerade detection method in in‐vehicle network

Zhang

Xiao

Zhang

et al. 2020

Trans Emerging Tel Tech

Self Cite

View full text Add to dashboard Cite

In‐vehicle network is easy to be attacked by masquerade attackers because of the controller local area network, and there are many intrusion detection systems to solve this problem. However, the traditional methods consider the transition and frequent property, but they lose the information of the cooccurrence. In this article, a novel method based on cooccurrence matrixes is proposed, and it makes use of the cooccurrence property of the command stream, which is often ignored. There are two steps in the training process. First, a relatively large number of distinct shell commands are transformed into a smaller number of unique events by hierarchically merging shell commands. Second, considering the correlation property of audit data, the method constructs a partly normalized cooccurrence matrix to profile the valid user's normal behaviors. Although performing detection, the partly normalized cooccurrence matrixes of the current event sequences are generated. Then the distances between these matrixes and the profile matrix are calculated with sliding windows. Finally, distances are used to determine whether they are normal or not. Our method is evaluated against two standard masquerade detection datasets provided by T. Lane et al and M. Schonlau et al, respectively. The results indicate that the proposed method is promising in terms of detection accuracy, which is at least 10% higher than other four solutions, and the proposed method has fewer memory requirements, which saves at most 90% of the compared methods, and it can be conducted in parallel and is more suitable for real‐time masquerade detection.

show abstract

A variable-length model for masquerade detection

Cited by 8 publications

References 11 publications

Model for Detection of Masquerade Attacks Based on Variable-Length Sequences

Model for Detection of Masquerade Attacks Based on Variable-Length Sequences

Sequence‐based masquerade detection for different user groups

A co‐occurrence matrix based masquerade detection method in in‐vehicle network

Contact Info

Product

Resources

About