Creating User Profiles from a Command-Line Interface: A Statistical Approach

Abstract

Abstract. Knowledge about computer users is very beneficial for assisting them, predicting their future actions or detecting masqueraders. In this paper, an approach for creating and recognizing automatically the behavior profile of a user from the commands (s)he types in a commandline interface, is presented.Specifically, in this research, a computer user behavior is represented as a sequence of UNIX commands. This sequence is transformed into a distribution of relevant subsequences in order to find out a profile that defines its behavior. Then, statistical methods are used for recognizing a user from the commands (s)he types. The experiment results, using 2 different sources of UNIX command data, show that a system based on our approach can efficiently recognize a UNIX user. In addition, a comparison with a HMM-base method is done.Because a user profile usually changes constantly, we also propose a method to keep up to date the created profiles using an age-based mechanism.

Creating Evolving User Behavior Profiles Automatically

“…These commands are inherently sequential, and this sequentiality is considered in the modeling process. According to this aspect and based on the work done in [2], in order to get the most representative set of subsequences from a sequence, we propose the use of a trie data structure [32]. This structure was also used in [33] to classify different sequences and in [34], [35] to classify the behavior patterns of a RoboCup soccer simulation team.…”

“…In recent years, significant work has been carried out for profiling users, but most of the user profiles do not change according to the environment and new goals of the user. An example of how to create these static profiles is proposed in a previous work [2].…”

Evolving classification of agents’ behaviors: a general approach

“…Once the sequence has been segmented and based on the work done in (Iglesias et al 2009), we propose the use of a trie data structure (Fredkin 1960) for storing the subse quences. This structure was also used in (Iglesias et al 2007) to classify different sequences and in (Kaminka et al 2002;Iglesias et al 2006) to classify the behavior patterns of a RoboCup soccer simulation team.…”

User modeling: Through statistical analysis and an evolving classifier

“…The construction of a user profile from a single sequence of commands is done as it is explained in [6] for any sequence of events. This process consists of three steps: 1.…”

“…This research is also focused on finding relevant users behavioral patterns in order to classify a user behavior. We will use the approach presented in [6] for automatically creating the profile of a user based on the analysis of the sequence of commands s/he typed.…”