Autom atic Profiling and Behavior Prediction of Computer System Users

Abstract

Detecting changes in the behavior of users can serve as an indicator of malicious or damaging misuse in many services; including the possible usurpation of a regular user identity by an intruder. For these purposes, approaches based on the profiling of users are not as common as those based on the analysis of the system behavior. This paper presents a method for automatically profiling and subsequently predicting the behavior of computer system users. The method is based on evolutionary profiling agents evolving in real time in order to dynamically provide a profile for each subject under analysis. The paper presents some experimental results from real data providing scheduled time and the real effective use of resources made by users of a High Performance Computing (HPC) center. The resulting profiling turns out to be very good for most users and the consequential relative error between prediction and effective activities appears as an effective parameter in detecting both changes in user behavior and user identity usurpation.