Multi Application User Profiling for Masquerade Attack Detection

Saljooghinejad, Hamed; Rathore, Wilson Naik

doi:10.1007/978-3-642-22714-1_70

Cited by 1 publication

(1 citation statement)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The disadvantages of their work were that they collected data only from a single window and did not consider the complexity of profiling multi applications. It was [4] who later showed the advantages of user profiling across multiple applications. Other activity regarding GUI based detections can be found in [3] which does not use mouse movements or keystroke dynamics but rather profiles how the user manipulates the windows, icons and menus.…”

Section: Background and Related Workmentioning

confidence: 99%

Layered Security Architecture for Masquerade Attack Detection

Saljooghinejad

Bhukya

2012

Data and Applications Security and Privacy XXVI

Self Cite

View full text Add to dashboard Cite

Abstract. Masquerade attack refers to an attack that uses a fake identity, to gain unauthorized access to personal computer information through legitimate access identification. Automatic discovery of masqueraders is sometimes undertaken by detecting significant departures from normal user behavior. If a user's normal profile deviates from their original behavior, it could potentially signal an ongoing masquerade attack. In this paper we proposed a new framework to capture data in a comprehensive manner by collecting data in different layers across multiple applications. Our approach generates feature vectors which contain the output gained from analysis across multiple layers such as Window Data, Mouse Data, Keyboard Data, Command Line Data, File Access Data and Authentication Data. We evaluated our approach by several experiments with a significant number of participants. Our experimental results show better detection rates with acceptable false positives which none of the earlier approaches has achieved this level of accuracy so far. Keywords:Masquerade Detection, Intrusion Detection System, Anomaly Detection, User Profiling. IntroductionMasquerade attacks are ranked second on the top five lists of electronic crimes perpetrated after viruses, worms or other malicious code attacks. The most common information, which can be used to detect masquerade attacks, is contained within the actions a masquerader performs. This set of actions is known as a behavioral profile. Behavior is not something that can be easily stolen. Masquerade detection techniques are based on the premise that when a masquerader attacks the system he will sufficiently deviate from the user's behavior and thus can be recognized using machine learning techniques [9]. In this paper we demonstrate an approach for detecting masqueraders in an efficient manner. We show how multiple layers of user data records together can construct a meaningful behavioral profile in order to have better detection results. The paper is organized as follows: next section introduces the related works on masquerade detection. Then, we describe architecture for the layered approach, which is followed by the experimental designs including data collection, feature extraction, learning and classification phases. Results of several experiments and conclusion are presented in last sections.

show abstract

Section: Background and Related Workmentioning

confidence: 99%