GSketch: A Comprehensive Graph Analytic Approach for Masquerader Detection Based on File Access Graph
Jianguo Jiang, Xu Wang, Yan Wang, Qiujian Lv, MeiChen Liu, Tingting Wang, Leiqi Wang · 2021 IEEE Symposium on Computers and Communications (ISCC) · 2021
Masqueraders are a severe insider threat and have become a conventional security issue for most organizations. The majority of existing techniques for detecting masqueraders extract statistical features from file access logs. However, the graph's features from these logs have not been fully explored. In this work, we introduce GSketch. First, it divides each user's file access logs into equal length, non-overlapping time windows. Then file access logs on each time window are transformed into a graph according to chronological order. GSketch extracts global features and local features from the graph. Global features provide a panoramic view of the graph, and local features mine small, induced sub-graphs. Finally, GSketch applies an abnormal detection algorithm to find anomalous points in the feature space and marks these points as masquerader's activities. The effectiveness of GSketch is demonstrated by its excellent performances on two public datasets - WUIL and TWOS.