Masquerade Detection through GUIID
Eric S. Imsand, John A. Hamilton · 2008
A masquerade attack is any attack in which the attacker is able to make the target system believe they are someone they are not. One particularly dangerous example of a masquerade attack occurs when an attacker uses an unattended, unlocked computer workstation. We present the results of a study into a new form of user authentication that can be used to defend against this type of masquerade attack. This new authentication scheme, which we call GUI-based intrusion detection ("GUIID"), examines the manner in which a user is interacting with the graphical user interface. Our results show that a user's current behavior can be compared to previously observed behaviors to find masquerade attacks. Our results demonstrate the feasibility of systems using GUIID as a means of detecting masquerade style intrusions.