User Profiling in GUI based Windows Systems for Intrusion Detection

Abstract

User Profiling in GUI based Windows Systems for Intrusion Detection by Arshi Agrawal Intrusion detection is the process of identifying any unauthorized access to a system. This process inspects user behavior to identify any possible attack or intrusion. There exists two type of intrusion detection systems (IDSs): signature-based IDS and anomaly-based IDS. This project concentrates on anomaly-based intrusion detection technique. This technique is based on the deviation of intruder's actions from the authenticated user's actions. Much previous research has focused on the deviation of command line input in UNIX systems. However, these techniques fail to detect attacks on modern GUIbased systems, where typical user activities include mouse movements and keystrokes. Our project aims to create a dataset suitable for testing intrusion detection strategies on GUI-based operating systems. We have developed an event logging tool to capture GUI-based user data on Windows systems. We have collected a large dataset which we analyze using a intrusion detection strategy based on hidden Markov models (HMM). ACKNOWLEDGMENTS I would like to thank Dr. Mark Stamp for his constant support, guidance and encouragement provided throughout the project. His patience and thoughtfulness was one of the biggest supporting factor for me in this project. I would also like to express my sincere gratitude to my committee members Dr. Chris Pollett and Dr. Sami Khuri for their valuable time and guidance. I am grateful to my friends and family for helping me in collecting a large amount of user data and spending their time and energy in making my project successful. Finally, I would like to thank my husband Mr. Arun Agrawal for his encouragement and unending patience throughout my Masters. v