Masquerade detection using truncated command lines

Maxion, Roy A.; Townsend, T.N.

doi:10.1109/dsn.2002.1028903

Cited by 157 publications

(115 citation statements)

References 6 publications

Supporting

Mentioning

115

Contrasting

Order By: Relevance

“…Maxion and Townsend [10] applied a naïve Bayes classifier and provided a detailed investigation of classification errors [11] highlighting why some masquerade victims are more vulnerable or more successful than others. Wang and Stolfo compared the performance of a naïve Bayes classifier and a SVM classifier to detect masqueraders [18].…”

Section: Related Workmentioning

confidence: 99%

“…[8,15] 26.8 3.7 IPAM [6,15] 41.1 2.7 Naïve Bayes (w. Updating) [10] 61.5 1.3 Naïve Bayes (No Upd.) [10] 66.2 4.6 Semi-Global Alignment [4] 75.8 7.7 Sequence Alignment (w. Upd.)…”

Section: Related Workmentioning

confidence: 99%

“…Previous work has focused on auditing and modeling sequences of user commands including work on enriching command sequences with information about arguments of commands [15,10,18]. We propose an approach to profile a user's search behavior by auditing search-related applications and accesses to index files, such as the index file of the Google Desktop Search application.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Modeling User Search Behavior for Masquerade Detection

Salem

Stolfo

2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Masquerade attacks are a common security problem that is a consequence of identity theft. This paper extends prior work by modeling user search behavior to detect deviations indicating a masquerade attack. We hypothesize that each individual user knows their own file system well enough to search in a limited, targeted and unique fashion in order to find information germane to their current task. Masqueraders, on the other hand, will likely not know the file system and layout of another user's desktop, and would likely search more extensively and broadly in a manner that is different than the victim user being impersonated. We identify actions linked to search and information access activities, and use them to build user models. The experimental results show that modeling search behavior reliably detects all masqueraders with a very low false positive rate of 1.1%, far better than prior published results. The limited set of features used for search behavior modeling also results in large performance gains over the same modeling techniques that use larger sets of features. *

show abstract

Section: Related Workmentioning

confidence: 99%

“…[8,15] 26.8 3.7 IPAM [6,15] 41.1 2.7 Naïve Bayes (w. Updating) [10] 61.5 1.3 Naïve Bayes (No Upd.) [10] 66.2 4.6 Semi-Global Alignment [4] 75.8 7.7 Sequence Alignment (w. Upd.)…”

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Modeling User Search Behavior for Masquerade Detection

Salem

Stolfo

2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Work on masquerade detection (and, more generally, on profiling user behavior for security purposes) has proliferated over the last decade, especially concerning the study of different detection strategies. Some of the proposals include the use of Bayes classifiers and Support Vector Machines [12][13][14][15][16]; information-theoretic approaches [17,18]; hidden Markov models [19]; or sequence-and text-mining [20][21][22][23] schemes, among others. Despite the diversity of principles behind these methods, the reported results show that they all perform similarly in terms of accuracy.…”

Section: Evaluation Frameworkmentioning

confidence: 99%

Online Randomization Strategies to Obfuscate User Behavioral Patterns

2012

View full text Add to dashboard Cite

When operating from the cloud, traces of user activities and behavioral patterns are accessible to anyone with enough privileges within the system. This could be, for example, the case of dishonest technical staff who may well be interested in selling user logs to competitors. In this paper, we investigate some of the security and privacy leakages derived from the analysis of user activities. We show that the working behavioral patterns exhibited by users can be easily captured into computationally useful representations that would allow an adversary to predict future activities, detect the occurrence of events of interest, or infer the organization's internal structure. We then introduce the idea of obfuscating user behaviour through Online Action Randomization Algorithms. In doing so, we introduce an indistinguishability-based definition for perfectly obfuscated actions and a concrete scheme to randomize user traces in an incremental way. We report experimental results confirming the obfuscation quality and other properties of the proposed schemes.

show abstract

“…An alternative method, proposed by [15], uses naïve Bayes to estimate the probability that a command c can be issued by user u. This method builds a profile for a user, so-called self, from a set of training data.…”

Section: Related Workmentioning

confidence: 99%

On the Use of Word Networks to Mimicry Attack Detection

Godínez

Hutter²,

Monroy

2006

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Intrusion detection aims at raising an alarm any time the security of an IT system gets compromised. Though highly successful, Intrusion Detection Systems are all susceptible of mimicry attacks [1]. A mimicry attack is a variation of an attack that attempts to pass by as normal behaviour. In this paper, we introduce a method which is capable of successfuly detecting a significant and interesting sub-class of mimicry attacks. Our method makes use of a word network [2,3]. A word network conveniently decomposes a pattern matching problem into a chain of smaller, noise-tolerant pattern matchers, thereby making it more tractable. A word network is realised as a finite state machine, where every state is a hidden Markov model. Our mechanism has shown a 93% of effectivity, with a false positive rate of 3%.

show abstract

Masquerade detection using truncated command lines

Abstract: Abstract

Cited by 157 publications

References 6 publications

Modeling User Search Behavior for Masquerade Detection

Modeling User Search Behavior for Masquerade Detection

Online Randomization Strategies to Obfuscate User Behavioral Patterns

On the Use of Word Networks to Mimicry Attack Detection

Contact Info

Product

Resources

About