Abstract:In-vehicle network is easy to be attacked by masquerade attackers because of the controller local area network, and there are many intrusion detection systems to solve this problem. However, the traditional methods consider the transition and frequent property, but they lose the information of the cooccurrence. In this article, a novel method based on cooccurrence matrixes is proposed, and it makes use of the cooccurrence property of the command stream, which is often ignored. There are two steps in the training process. First, a relatively large number of distinct shell commands are transformed into a smaller number of unique events by hierarchically merging shell commands. Second, considering the correlation property of audit data, the method constructs a partly normalized cooccurrence matrix to profile the valid user's normal behaviors. Although performing detection, the partly normalized cooccurrence matrixes of the current event sequences are generated. Then the distances between these matrixes and the profile matrix are calculated with sliding windows. Finally, distances are used to determine whether they are normal or not. Our method is evaluated against two standard masquerade detection datasets provided by T. Lane et al and M. Schonlau et al, respectively. The results indicate that the proposed method is promising in terms of detection accuracy, which is at least 10% higher than other four solutions, and the proposed method has fewer memory requirements, which saves at most 90% of the compared methods, and it can be conducted in parallel and is more suitable for real-time masquerade detection.

An Intent-Driven Masquerader Detection Framework Based on Data Fusion

IDU-Detector: A Synergistic Framework for Robust Masquerader Attack Detection

A Labeled RFS-Based Framework for Multiple Integrity Attackers Detection and Identification in Cyber-Physical Systems

Masquerade Detection Based on Shell Commands and High-Order Markov Chain Models

Masquerade Intrusion Detection Based on Network Flow Statistical Data

Multi-Domain Information Fusion for Insider Threat Detection

Modeling User Network Behavior Based on Network Packet Sketches for Masquerade Detection

GSketch - A Comprehensive Graph Analytic Approach for Masquerader Detection Based on File Access Graph.

A Graph Based Framework for Malicious Insider Threat Detection

E-Watcher: insider threat monitoring and detection for enhanced security

A Fusion Model Based on Dynamic Web Browsing Behavior Analysis for IoT Insider Threat Detection

A co-occurrence matrix based masquerade detection method in in-vehicle network

A Hidden Markov Model Based Framework for Tracking and Predicting of Attack Intention

A Hybrid Model Based On Multi-Dimensional Features For Insider Threat Detection

PAITS: Detecting Masquerader via Short-Lived Interventional Mouse Dynamics

Masquerade Detection Based on One Class Svm

A Probabilistic Analysis Framework for Malicious Insider Threats.

An Intrusion Detection Framework Based on Information Fusion

A Digest and Pattern Matching-Based Intrusion Detection Engine

An Intrusion Detection Framework Based on Hybrid Multi-Level Data Mining