Detect Masqueraders Using UNIX Command Sequences

Peng Jia,R. Maxion
Abstract:Masqueraders are people who impersonate other people on a computer system and they pose threat to the system security. This paper reported two experiments on masquerader detection using UNIX command sequences. One experiment detects masquerader using normal user activity variation measured by distance between two adjacent sequences’ probability distributions. The other method use Naive Bayes classifiers and detect masqueraders by looking at the classifiers misclassification behavior. Both methods use command occurrence probability distribution modeling the UNIX sequence. The Naïve Bayes classifier shows better detection performance measured by missing alarm rate and false alarm rate, this method was analyzed in more detail in user self-recognition analysis. The results show that Naïve Bayes classifier behaves differently for various user command generating patterns.
What problem does this paper attempt to address?