Abstract:This paper presents an intrusion detection method based on the information obtained from real time key sequences. By analyzing the keystroke characteristics and algorithms for keystroke identification with a large numbers of experiments,a weighted Bayesian method using stroke sequences of particular keys as data source is developed. The keystroke models of normal users are established first and then applied to match the keystroke sequences of all users in real time to determine if intrusion taking place. This method can not only perform user authentication beyond login names and passwords, but also constantly monitor the dynamic behaviors of users’ keystroke processes to prevent abusive usage of a particular account of the false users. The paper also discusses the key issues of system implementation and presents the detection results from a real system. Experiments on 1912 login keystroke sequences of 15 users show that the weighted Bayesian method can achieve a false negative ratio of 0.58% and a false positive ratio of 1.64% for user verification, in comparison with the traditional Bayesian method with the about ratios of 2.90% and 6.38%,respectively.The experiments are also performed to test the capability for monitoring the dynamic behaviors of users’ keystroke processes.The results for 1147 keystroke sequences of the same 15 users show that authors’ method is better with the false negative ratios of 2.61% and false positive 5.73% in comparison with 3.77% and 7.36% for traditional Bayesian method.

Low-cost Intrusion Detection Method Based on Statistical Language Models

A Low-Cost Method to Intrusion Detection System Using Sequences of System Calls

An Intrusion Detection System Based On System Call

Intrusion Detection Based on System Calls and Call Stack Log

Multi-agent based hybrid Intrusion detection system

Analyzing and Improving Performance of a Class of Anomaly-based Intrusion Detectors

Efficient Intrusion Detection Based on Static Analysis and Stack Walks

Intrusion Detection Method Based on Two-Layer HMM

Smart Intrusion Detection Method Using Negative Selection Algorithm Based on Maximum Entropy Model

Intrusion Detection Based on the Short Sequence Model

Toward cost-sensitive modeling for intrusion detection and response

Intrusion Detection Using Variable-length System Calls Patterns

Network Intrusion Detection Method Based on Rough Set Theory

Modeling program behaviors by hidden Markov models for intrusion detection

Intrusion Detection at Scale with the Assistance of a Command-line Language Model

Design of an Intrusion Detection Model under Linux Based on System-call Monitoring

An Efficient Content-based Intrusion Detection System

A New Intelligent Intrusion Detection Method Based on Attribute Reduction and Parameters Optimization of SVM

The Host-Based Intrusion Detection Based on Real Time Keystroke Sequences

Intrusion Detection Models Based on Data Mining

Host-based Intrusion Detection Using Dynamic and Static Behavioral Models.