Paper Info
Title
Efficient Masquerade Detection Using Svm Based On Common Command Frequency In Sliding Windows
Abstract
Masqueraders who impersonate other users pose serious threat to computer security. Unfortunately, firewalls or misuse-based intrusion detection systems are generally ineffective in detecting masqueraders. Anomaly detection techniques have been proposed as a complementary approach to overcome such limitations. However, they are not accurate enough in detection, and the rate of false alarm is too high for the technique to be applied in practice. For example, recent empirical studies on masquerade detection using UNIX commands found the accuracy to be below 70%. In this research, we per-formed a comparative study to investigate the effectiveness of SVM (Support Vector Machine) technique using the same data set and configuration reported in the previous experiments. In order to improve accuracy of masquerade detection, we used command frequencies in sliding windows as feature sets. In addition, we chose to ignore commands commonly used by all the users and introduce the concept of voting engine. Though still imperfect, we were able to improve the accuracy of masquerade detection to 80.1% and 94.8%, whereas previous studies reported accuracy of 69.3% and 62.8% in the same configurations. This study convincingly demonstrates that SVM is useful as an anomaly detection technique and that there are several advantages SVM offers as a tool to detect masqueraders.
Year
Venue
Keywords
2004
IEICE TRANSACTIONS ON INFORMATION AND SYSTEMS
intrusion detection, masquerade detection, anomaly detection, machine learning, SVM (Support Vector Machine), user command
Field
DocType
Volume
Anomaly detection,Pattern recognition,Computer science,Support vector machine,Speech recognition,Artificial intelligence,Intrusion detection system
Journal
E87D
Issue
ISSN
Citations 
11
1745-1361
2
PageRank 
References 
Authors
0.43
0
2
Name
Order
Citations
PageRank
Han-Sung Kim1554.60
Sung Deok Cha238129.92