An EvABCD approach for masquerade detection

Abstract

Masqueraders are people who use somebody else's computer account. Masquerade attacks are serious in nature in the case of an insider, who can cause considerable damage to an organization. The insider attack detection problem remains one of the more important research areas requiring new insights to alleviate against this threat. Detection of these attacks is done by monitoring significant changes in user's behavior based on his or her profile. Knowledge about computer user's are helpful for assisting them, for predicting their future actions. Masquerade detection and predicting future actions of a computer user is done. It is done by constructing user behavior profiles by observing user behaviors. User behaviors involve local activities and network activities of a computer user. Propose an evolving approach, for constructing user behavior profiles since human behavior changes and is unpredictable. Percentage of activities in user behavior profile determines a masquerader user and a normal user.