Internal Attack Identification and Inhibition System using Cosine Similarity for Abnormal User Detection

Abstract

Network security plays a vital role in the prevention of data transmission network from the unauthorized access and illegal activities performed by the malicious users. Various security mechanisms include encryption and decryption, password protection, firewalls, anti-malware applications, Intrusion Detection Systems etc. Even though, these mechanisms prevents the network from security attacks, they fail to identify the internal attackers. The internal attackers causes equivalent damage as the external attackers. As the internal attackers imitate the authorized users, it is tedious to identify those attackers. In order to address the abovementioned issues, this paper proposes an Internal Attack Identification and Inhibition System (IAIIS) by combining the data mining and forensic techniques. The System Call (SC) of the users at the kernel are analyzed in the proposed IDS. The Cosine Similarity (CS) is applied to compare the profiles of the users to find, whether the user is a normal user or an abnormal user. The experimental results evaluate the proposed system in terms of detection accuracy, decisive rate threshold, response time, abnormal user count, and false alarm rate.