Unsupervised anomaly detection within non‐numerical sequence data by average index difference, with application to masquerade detection

Abstract

Anomaly detection within non‐numerical sequence data has developed into an important topic of data mining, but comparatively little research has been done regarding anomaly detection without training data (unsupervised anomaly detection). One application found in computer security is the detection of a so‐called masquerade attack, which consists of an attacker abusing a regular account. This leaves only the session input, which is basically a string of non‐numerical commands, for analysis. Our previous approach to this problem introduced the use of the so‐called average index difference function for mapping the non‐numerical symbol data to a numerical space. In the present paper, we examine the theoretical properties of the average index difference function, present an enhanced unsupervised anomaly detection algorithm based on the average index difference function, show the parameters to be theoretically inferable, and evaluate the performance using real‐world data. Copyright © 2014 John Wiley & Sons, Ltd.