Empirical evaluation of SVM-based masquerade detection using UNIX commands

Masqueraders who impersonate other users pose serious threat to computer security. Unfortunately, firewalls or misuse-based intrusion detection systems are generally ineffective in detecting masquerades. Although anomaly detection techniques have tong been considered as an effective approach to complement misuse detection techniques, they are not widely used in practice due to poor accuracy and relatively high degree of false alarms. In this paper, we performed an empirical study investigating the effectiveness of SVM (support vector machine) in detecting masquerade activities using two different UNIX command sets used in previous studies [R. Maxion, N. Townsend, Proceedings of international conference on dependable systems and networks (DSN-02), p. 219-28, June 2002; R. Maxion, Proceedings of international conference on dependable systems and networks (DSN-03), p. 5-14, June 2003]. Concept of common commands was introduced as a feature to more effectively reflect diverse command patterns exhibited by various users. Though still imperfect, we detected masquerades 80.1% and 94.8% of the time, white the previous studies reported the accuracy of 69.3% and 62.8%, respectively, using the same data set containing only the command names. When command names and arguments were included in the experiment, SVM-based approach detected masquerades 87.3% of the time white the previous study, using the same data set, reported 82.1% of accuracy. These combined experiments convincingly demonstrate that SVM is an effective approach to masquerade detection.
Publisher
ELSEVIER ADVANCED TECHNOLOGY
Issue Date
2005-03
Language
ENG
Keywords

COMPUTER INTRUSION

Citation

COMPUTERS & SECURITY, v.24, pp.160 - 168

ISSN
0167-4048
DOI
10.1016/j.cose.2004.08.007
URI
http://hdl.handle.net/10203/87381
Appears in Collection
RIMS Journal Papers
Files in This Item
There are no files associated with this item.
  • Hit : 143
  • Download : 0
  • Cited 0 times in thomson ci
This item is cited by other documents in WoS
⊙ Detail Information in WoSⓡClick to seewebofscience_button
⊙ Cited 25 items in WoSClick to see citing articles inrecords_button

qr_code

  • mendeley

    citeulike


rss_1.0 rss_2.0 atom_1.0