Masquerade Detection Based on One Class SVM
Yuxin Ding, Ping Sun, Xiuyue Chen, Changan Liu · 2008
Masqueraders invade into users'system and impersonate the real users to do whatever they want.Unfortunately, firewalls or misuse-based intrusion detection systems are generally ineffective in detecting masquerades.In this paper an abnormal detection method based on one class SVM are presented to detect masquerade activities using UNIX command sets.Firstly the performance of binary SVM classifier are studied to illustrated why one class SVM are adopted, then to improve the performance of one class SVM different feature selection methods are studied, experimental results show that for abnormal detection using UNIX command simplifying raw data and decreasing the dimensions of feature space is an effective approach to improve the performance of SVM classifiers for masquerade detection.