Session comparison measurement and learning in masquerading detection
Chen Yinru, Mats Åström, Lihong Wang · Diva portal (Dalarna University Library) · 2004
In applying command sequence matching to detect masquerading attack, the first important step is to build a user's profile for characterizing normal behavior. In this paper, we proposed a new approach which applies the comparison of arbitrary length of sessions to distinguish users. In this approach, a session is regarded as an integral comparison unit. This method makes it possible to locate command matches in historical command data for long sequences. The testing results show that the method can be used in creating a user's profile. Further, it will pave the road for future work in applying data mining technology to detect potential masqueraders.