Adaptive Naive Bayes method for masquerade detection

Dash, Subrat Kumar; Reddy, Krupa Sagar; Pujari, Arun K.

doi:10.1002/sec.168

Cited by 14 publications

(6 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We assumed that, in the detection stage, the commands of a misbehaving user may match the commands of a normal user for a short period of time but will eventually differ over a longer period [4,6,8]. Therefore, we can make decisions about the type of behavior by considering w short state sequences, where w is the window size.…”

Section: ) Computing the Decision Valuesmentioning

confidence: 99%

See 1 more Smart Citation

Model for Detection of Masquerade Attacks Based on Variable-Length Sequences

2020

View full text Add to dashboard Cite

A masquerader is an attacker who gains illegitimate access to a user's account. Masquerade detection is one of the key problems of intrusion detection systems. Deep learning models that obtained state-of-the-art results in masquerade detection have failed to exhibit very high detection performance when data samples contain limited information. Alternatively, computationally cheaper and more memoryefficient traditional machine learning models suffer from less robust features, which hinders them in achieving high detection performance. The contributions of this paper are as follows: we introduce new features of variable-length UNIX command sequences (i.e., weighted occurrence frequencies of different orders) and integrate these features into an extended Markov-chain-based variable-length model. The detection performance of our model is evaluated on three publicly available and free datasets: Schonlau (SEA), Purdue (PU), and Greenberg. The results demonstrate that our model significantly improves the true positive rate (TPR), false positive rate, receiver operator characteristic, and threshold variance compared to the baselines (other Markov-chain-based variable-length models). Furthermore, in terms of the TPR, the proposed method is superior to a state-of-the-art deep learning model that uses a convolutional neural network on the PU and Greenberg datasets and a state-of-the-art sequence-alignment-hidden Markov model on the SEA dataset. Moreover, the proposed method is much more lightweight than the state-of-the-art models in terms of computational and memory complexity, and thus more suitable for real-time masquerade detection.

show abstract

Section: ) Computing the Decision Valuesmentioning

confidence: 99%

“…In the training stage, features are extracted to model normal user behavior. In the detection stage, an audited user's behavior is classified as normal or anomalous (or doubtful as done by Dash et al [8]) based on its deviation from the modeled normal behavior.…”

Section: Introductionmentioning

confidence: 99%

Model for Detection of Masquerade Attacks Based on Variable-Length Sequences

2020

View full text Add to dashboard Cite

show abstract

“…Dash et al presented an adaptive Naive Bayes method for masquerade detection. 24 M.D. Wan et al detected masqueraders with high-frequency commands as signatures.…”

Section: Related Workmentioning

confidence: 99%

A co‐occurrence matrix based masquerade detection method in in‐vehicle network

Zhang

Xiao

Zhang

et al. 2020

Trans Emerging Tel Tech

View full text Add to dashboard Cite

In‐vehicle network is easy to be attacked by masquerade attackers because of the controller local area network, and there are many intrusion detection systems to solve this problem. However, the traditional methods consider the transition and frequent property, but they lose the information of the cooccurrence. In this article, a novel method based on cooccurrence matrixes is proposed, and it makes use of the cooccurrence property of the command stream, which is often ignored. There are two steps in the training process. First, a relatively large number of distinct shell commands are transformed into a smaller number of unique events by hierarchically merging shell commands. Second, considering the correlation property of audit data, the method constructs a partly normalized cooccurrence matrix to profile the valid user's normal behaviors. Although performing detection, the partly normalized cooccurrence matrixes of the current event sequences are generated. Then the distances between these matrixes and the profile matrix are calculated with sliding windows. Finally, distances are used to determine whether they are normal or not. Our method is evaluated against two standard masquerade detection datasets provided by T. Lane et al and M. Schonlau et al, respectively. The results indicate that the proposed method is promising in terms of detection accuracy, which is at least 10% higher than other four solutions, and the proposed method has fewer memory requirements, which saves at most 90% of the compared methods, and it can be conducted in parallel and is more suitable for real‐time masquerade detection.

show abstract

“…Yung updated user behaviors with feedback from users in order to increase detection performance. A recent approach using naive Bayes is proposed in , where the detection of an attacker is deferred for 2–3 blocks.…”

Section: Related Workmentioning

confidence: 99%

Sequence‐based masquerade detection for different user groups

Şen

2014

Security Comm Networks

View full text Add to dashboard Cite

Insider threats are one of the biggest threats that organizations are confronted with today. A masquerader who impersonates another user for his malicious activities has been studied extensively in the literature. The approaches proposed on masquerade detection mainly assume that masquerader behavior will deviate from the typical behavior of the victim. This research presents a rigorous evaluation of sequence-based approaches based on this assumption. The main idea underlying sequence-based approaches is that users type similar commands, in a similar order, every time to do a specific job and, these similarities could distinguish users from others. Sequence-based approaches in the literature only consider commands typed in a specific order, at all times. In this research, we also take into account typing similar commands in a command sequence, but in an unordered way, in the newly proposed method, Matching of Unordered Command Sequences. We compare this new technique with another sequence-based approach called Matching of Ordered Command Sequences, and a command-based approach called Matching of Commands. These techniques are evaluated with varying parameters in order to explore how the order of commands, the variations in a command sequence, and the variety of commands affect masquerade detection. Furthermore, the performance of these methods on different types of users and masqueraders is analyzed. We explore what kind of users are easily distinguishable from others, and what kind of masqueraders are difficult to detect.

show abstract

Adaptive Naive Bayes method for masquerade detection

Cited by 14 publications

References 23 publications

Model for Detection of Masquerade Attacks Based on Variable-Length Sequences

Model for Detection of Masquerade Attacks Based on Variable-Length Sequences

A co‐occurrence matrix based masquerade detection method in in‐vehicle network

Sequence‐based masquerade detection for different user groups

Contact Info

Product

Resources

About