Masquerade Detection Research Articles

Detecting impersonation attacks in cloud computing environments using a centric user profiling approach

Cloud computing has become the most needed technology for the IT industry. Impersonation attacks are among the most dangerous threats that Clouds face. In this paper, we present an approach to detect masquerade attacks in Clouds. The efficient detection of these attacks should correlate user behaviors in distinct environments and also should apply to several deployment models. We present and evaluate three approaches to detect Impersonation and masquerade attacks. The first approach analyzes sequences of correlated system calls from the VMs operating systems, while the second analyzes the NetFlow data from the network environment. The third approach integrates these two approaches by using a neural network that will produce better detections than any of the first two approaches. To simplify the testing and the evaluation of the three methods, the Cloud Intrusion Detection Dataset (CIDD) is used as a source for cloud audits data. The evaluation has considered alternative deployment models through our two intrusion detection frameworks, CIDS and CIDS-VIRT. The paper also shows that the proposed detection approaches are more accurate and outperform the SWAD-MMD, a recent masquerade detection framework that works in the cloud computing systems. Furthermore, the paper details our experimental results and evaluates the computational performance and the detection accuracy of these approaches.

Obfuscation of Malicious Behaviors for Thwarting Masquerade Detection Systems Based on Locality Features.

In recent years, dynamic user verification has become one of the basic pillars for insider threat detection. From these threats, the research presented in this paper focuses on masquerader attacks, a category of insiders characterized by being intentionally conducted by persons outside the organization that somehow were able to impersonate legitimate users. Consequently, it is assumed that masqueraders are unaware of the protected environment within the targeted organization, so it is expected that they move in a more erratic manner than legitimate users along the compromised systems. This feature makes them susceptible to being discovered by dynamic user verification methods based on user profiling and anomaly-based intrusion detection. However, these approaches are susceptible to evasion through the imitation of the normal legitimate usage of the protected system (mimicry), which is being widely exploited by intruders. In order to contribute to their understanding, as well as anticipating their evolution, the conducted research focuses on the study of mimicry from the standpoint of an uncharted terrain: the masquerade detection based on analyzing locality traits. With this purpose, the problem is widely stated, and a pair of novel obfuscation methods are introduced: locality-based mimicry by action pruning and locality-based mimicry by noise generation. Their modus operandi, effectiveness, and impact are evaluated by a collection of well-known classifiers typically implemented for masquerade detection. The simplicity and effectiveness demonstrated suggest that they entail attack vectors that should be taken into consideration for the proper hardening of real organizations.

HMMs based masquerade detection for network security on with parallel computing

Masquerade detection is currently an active research topic in the field of network security. This paper presents a novel method for detecting masquerade attacks based on hidden Markov models (HMMs), which applies to host-based intrusion detection systems using Unix or Linux shell commands as audit data. The method employs multiple command sequences of different lengths to represent the behavioral patterns of a legitimate user and constructs a specific HMM to characterize the normal behavior profile of the user. Moreover, the adaptability and precision of user profiling are definitely taken into account. During training, the parameters of the HMM are calculated by parallel computing that is less computationally expensive than the classic Baum–Welch algorithm. At the detection stage, the occurrence probabilities of short state sequences are first computed to analyze behavior deviations that may indicate masquerade attacks, and two alternative decision schemes can be used to classify the monitored user’s behavior as normal or anomalous. The method addresses both detection accuracy and computational efficiency and is especially suitable for online detection. Our study empirically demonstrates the promising performance of the method.

A co‐occurrence matrix based masquerade detection method in in‐vehicle network

AbstractIn‐vehicle network is easy to be attacked by masquerade attackers because of the controller local area network, and there are many intrusion detection systems to solve this problem. However, the traditional methods consider the transition and frequent property, but they lose the information of the cooccurrence. In this article, a novel method based on cooccurrence matrixes is proposed, and it makes use of the cooccurrence property of the command stream, which is often ignored. There are two steps in the training process. First, a relatively large number of distinct shell commands are transformed into a smaller number of unique events by hierarchically merging shell commands. Second, considering the correlation property of audit data, the method constructs a partly normalized cooccurrence matrix to profile the valid user's normal behaviors. Although performing detection, the partly normalized cooccurrence matrixes of the current event sequences are generated. Then the distances between these matrixes and the profile matrix are calculated with sliding windows. Finally, distances are used to determine whether they are normal or not. Our method is evaluated against two standard masquerade detection datasets provided by T. Lane et al and M. Schonlau et al, respectively. The results indicate that the proposed method is promising in terms of detection accuracy, which is at least 10% higher than other four solutions, and the proposed method has fewer memory requirements, which saves at most 90% of the compared methods, and it can be conducted in parallel and is more suitable for real‐time masquerade detection.

Model for Detection of Masquerade Attacks Based on Variable-Length Sequences

A masquerader is an attacker who gains illegitimate access to a user’s account. Masquerade detection is one of the key problems of intrusion detection systems. Deep learning models that obtained state-of-the-art results in masquerade detection have failed to exhibit very high detection performance when data samples contain limited information. Alternatively, computationally cheaper and more memory-efficient traditional machine learning models suffer from less robust features, which hinders them in achieving high detection performance. The contributions of this article are as follows: we introduce new features of variable-length UNIX command sequences (i.e., weighted occurrence frequencies of different orders) and integrate these features into an extended Markov-chain-based variable-length model. The detection performance of our model is evaluated on three publicly available and free datasets: Schonlau (SEA), Purdue (PU), and Greenberg. The results demonstrate that our model significantly improves the true positive rate (TPR), false positive rate, receiver operator characteristic, and threshold variance compared to the baselines (other Markov-chain-based variable-length models). Furthermore, in terms of the TPR, the proposed method is superior to a state-of-the-art deep learning model that uses a convolutional neural network on the PU and Greenberg datasets and a state-of-the-art sequence-alignment-hidden Markov model on the SEA dataset. Moreover, the proposed method is much more lightweight than the state-of-the-art models in terms of computational and memory complexity, and thus more suitable for real-time masquerade detection.

Correlation‐based sequence alignment models for detecting masquerades in cloud computing

Despite the important benefits that cloud computing could offer, security remains one of the major concern that is hindering the development of this paradigm. Masquerades attacks and malicious insiders are often listed among the most dangerous challenges faced by cloud computing. The detection of masquerade attacks in cloud systems has to integrate host and network detection by correlating the user's behaviours in several virtual machines. The author has introduced two approaches that use sequences of events from the operating system and data from the network environment. Then, he integrated these approaches through a neural network that also considers information about the active session. Both approaches use his DDSGA method, a data-driven semi-global alignment approach for detecting masquerade attacks based on the alignment technique. He evaluated the efficiency and accuracy of the approaches through the Cloud Intrusion Detection Dataset. He also shows that the integrated approach results in the best accuracy and the proposed approaches outperform a recent masquerade detection framework that works in the cloud computing systems called the Sliding Window-based Anomaly Detection using Maximum Mean Discrepancy.

Comparative Evaluation of Different Classification Techniques for Masquerade Attack Detection

Masquerade detection is a special type of intrusion detection problem. Effective and early intrusion detection is a crucial basis for computer security. Although of considerable work has been focused on masquerade detection for more than a decade, achieving a high level of accuracy and a comparatively low degree of false alarm rate is still a big challenge. In this paper, we present an extensive empirical study in the area of user behaviour profiling-based masquerade detection using six of different existed machine learning methods in Azure Machine Learning (AML) studio. In order to surpass previous studies on this subject, we used four free and publicly available datasets with seven data configurations are implemented from them. Moreover, eight well-known masquerade detection evaluation metrics are used to assess methods performance against each data configuration. Finally, intensive quantitative and ROC curves analyses of results are provided at the end of this paper.

Deep Learning Approaches for Predictive Masquerade Detection

In computer security, masquerade detection is a special type of intrusion detection problem. Effective and early intrusion detection is a crucial factor for computer security. Although considerable work has been focused on masquerade detection for more than a decade, achieving a high level of accuracy and a comparatively low false alarm rate is still a big challenge. In this paper, we present a comprehensive empirical study in the area of anomaly-based masquerade detection using three deep learning models, namely, Deep Neural Networks (DNN), Long Short-Term Memory Recurrent Neural Networks (LSTM-RNN), and Convolutional Neural Networks (CNN). In order to surpass previous studies on this subject, we used three UNIX command line-based datasets, with six variant data configurations implemented from them. Furthermore, static and dynamic masquerade detection approaches were utilized in this study. In a static approach, DNN and LSTM-RNN models are used along with a Particle Swarm Optimization-based algorithm for their hyperparameters selection. On the other hand, a CNN model is employed in a dynamic approach. Moreover, twelve well-known evaluation metrics are used to assess model performance in each of the data configurations. Finally, intensive quantitative and ROC curves analyses of results are provided at the end of this paper. The results not only show that deep learning models outperform all traditional machine learning methods in the literature but also prove their ability to enhance masquerade detection on the used datasets significantly.

Bagging-RandomMiner: a one-class classifier for file access-based masquerade detection

Dependence on personal computers has required the development of security mechanisms to protect the information stored in these devices. There have been different approaches to profile user behavior to protect information from a masquerade attack; one such recent approach is based on user file-access patterns. In this paper, we propose a novel classification ensemble for file access-based masquerade detection. We have successfully validated the hypothesis that a one-class classification approach to file access-based masquerade detection outperforms a multi-class one. In particular, our proposed one-class classifier significantly outperforms several state-of-the-art multi-class classifiers. Our results indicate that one-class classification attains better classification results, even when unknown attacks arise. Additionally, we introduce three new repositories of datasets for the identification of the three main types of attacks reported in the literature, where each training dataset contains no object belonging to the type of attack to be identified. These repositories can be used for testing future classifiers, simulating attacks carried out in a real scenario.

A Survey on Object-based Masquerade Detection System using Temporal and Spatial Locality Features

A Survey on Object-based Masquerade Detection System using Temporal and Spatial Locality Features

Experimenting with masquerade detection via user task usage

Detecting whether a given activity in a device, corresponds to a legitimate device user or not, is usually carried out by looking for deviations in behavior against a normal usage baseline. One approach to this problem, called masquerade detection, uses the file system navigation information, comprised of the files, folders, and how the user navigates between them, to construct the normal usage baseline. Atop the file system navigation approach for masquerade detection, there is an alternate representation of file system usage which abstracts away a collection of interrelated files into a single symbol, denoting a task; thus, touching any of these files amounts to simply as executing a task. In this paper, we propose a refined notion of the task abstraction, which allows for a better characterization of the user. The improved abstraction makes possible to obtain a better Masquerade Detection System with increased efficiency, resulting in a faster detection of masqueraders.

Temporal and Spatial Locality: An Abstraction for Masquerade Detection

Most studies in masquerade detection focus mainly on the user action, ignoring the object upon which that action is performed. This may yield limited models, since, for example, command execution (an action) usually ends up in the transformation of a file (the object). The overall goal of this paper is to prove that the object is paramount to distinguishing a user from a masquerade. With this in mind, we have developed a new approach to masquerade detection, called file system navigation, and tested our ideas using the Windows-Users and Windows-Intruder simulations Logs Data set, (WUIL) which unlike other datasets of its kind includes close-to-real simulated attacks. We have shown that our approach makes it possible to capture computer behavior in an abstract way difficult to realize in a purely action-based approach. In this paper, we introduce an abstraction called locality, the tendency of programs to cluster references to memory. While temporal locality is applicable to both actions and objects, spatial locality is more suitable to objects, as it depends on a notion of position. We have successfully validated our working hypothesis: locality-based features better capture user behavior for masquerade detection. Particularly, results based on our approach report an Area Under the Curve (AUC) of the receiver operating characteristic curve value of 0.97 in average with 30% of users having an AUC equal to or above 0.99.

Bagging-TPMiner: a classifier ensemble for masquerader detection based on typical objects

The goal of a masquerade detection system is to determine whether a given computer activity does not correspond to a target user, thereby inferring that a masquerader has stolen the computer session of a user. Masquerade detection should be addressed as a one-class classification problem, where only user information is available for classifier construction. This might be mandatory when it is difficult to account for all types of attack patterns or collect enough evidence thereof. In this paper, we introduce a masquerader detection method, named Bagging-TPMiner, a one-class classifier ensemble. As the name suggests, Bagging-TPMiner bootstraps the training dataset of genuine user behavior in order to find typical objects. In the classification phase, it renders a new sample of computer behavior to be a masquerade if that behavior is distinct from the typical objects. Critically, unlike existing clustering techniques, Bagging-TPMiner gives similar attention to both types of regions, dense and sparse, thus capturing the (hidden) structure of ordinary user behavior. We have successfully tested Bagging-TPMiner on WUIL, a repository of datasets for masquerader detection that contain more faithful masquerade attempts. Our experimental results show that Bagging-TPMiner improves classification accuracy when compared to other classifiers and that it is significantly better at identifying bursts of attacks, called persistent attacks, or at continuously updating from prior mistakes.

Masquerade detection on GUI-based Windows systems

A masquerader is an attacker who attempts to mimic the behaviour of a legitimate user so as to evade detection. Much previous research on masquerade detection has focused on analysis of command-line input in UNIX systems. However, these techniques may fail to detect attacks on modern graphical user interface GUI-based systems, where typical user activities include mouse movements, in addition to keystrokes. We have developed an event logging tool for Windows systems which has been used to collect a large, publicly available dataset suitable for testing masquerade detection strategies. Using this dataset, we employ hidden Markov model HMM analysis to compare the effectiveness of various detection strategies. Our results show that a linear combination of keyboard activity and mouse movements, yields stronger results than when relying on keyboard activity alone, or mouse movements alone. These preliminary results can serve as a baseline for future masquerade detection research.

Sequence‐based masquerade detection for different user groups

ABSTRACTInsider threats are one of the biggest threats that organizations are confronted with today. A masquerader who impersonates another user for his malicious activities has been studied extensively in the literature. The approaches proposed on masquerade detection mainly assume that masquerader behavior will deviate from the typical behavior of the victim. This research presents a rigorous evaluation of sequence‐based approaches based on this assumption. The main idea underlying sequence‐based approaches is that users type similar commands, in a similar order, every time to do a specific job and, these similarities could distinguish users from others. Sequence‐based approaches in the literature only consider commands typed in a specific order, at all times. In this research, we also take into account typing similar commands in a command sequence, but in an unordered way, in the newly proposed method, Matching of Unordered Command Sequences. We compare this new technique with another sequence‐based approach called Matching of Ordered Command Sequences, and a command‐based approach called Matching of Commands. These techniques are evaluated with varying parameters in order to explore how the order of commands, the variations in a command sequence, and the variety of commands affect masquerade detection. Furthermore, the performance of these methods on different types of users and masqueraders is analyzed. We explore what kind of users are easily distinguishable from others, and what kind of masqueraders are difficult to detect. Copyright © 2014 John Wiley & Sons, Ltd.

Comparison of BP and SVM on SLA based Masquerader Detection in Cloud

Cloud computing is a new dynamics in the IT sector which imitates the pay per use modality of many commodity items. Organizations can use the new offerings in the IT field without significant capital investment. However, there is scrutiny in adoption of cloud computing in organizations as there are many economic, security and business risk associated with it. SLA between cloud service provider and cloud service user is a key in maintaining trust in the cloud services and achieve a common goal. Most SLAs focus on cloud computing performance while other issues don't get much attention. This study is oriented to build a masquerade detection system in cloud computing, based on the proposed SLA. The new SLA contains additional security constraints than that found in traditional SLA such as length of temporal sequence, weight of each activities and the threshold weight of the temporal sequence. The performance analysis includes comparison of Back Propagation algorithm with Support Vector Machine (SVM). The detection rate and false alarm rate is observed and found that it can detect masqueraders well from the small set of training data with small false alarm rate.

Using instance-weighted naive Bayes for adapting concept drift in masquerade detection

Although there are many approaches proposed for masquerade detection in the literature, few of them consider concept drift; the problem of distinguishing malicious behaviours from the natural change in user behaviours. Researchers mainly focus on updating user behaviours for adapting concept drift in masquerade detection. However, these approaches rely on the accuracy of the detector and do not take into account malicious instances which are erroneously added to the updating scheme. In this study, we show that conventional approaches based on instance selection are affected dramatically when misclassified intrusive data are added to the training data. Therefore, we propose a new approach based on instance weighting which updates user behaviours gradually according to the weights assigned to each instance, regardless of them being malicious or non-malicious. The results show that the proposed approach outperforms the other updating schemes in the literature, where the malicious instances are more than 5 % of the benign instances in the updating, which is very likely to happen due to the high miss rate of the existing detectors.

Detecting Masquerade in Face Recognition System – A Literature survey

A masquerader is an (often external) attacker is one who, after succeeding in obtaining a legitimateuser’s credentials, attempts to use the stolen identity to carry out malicious actions.Automatic detection of masquerading attacks is generally undertaken by approaching theproblem from an anomaly detection perspective: a model of normal behaviour for eachuser is constructed and significant departures from it are identified as potentialmasquerading attempts.The most common techniqueto masquerade a face recognition system is to use a photo print or a video of a valid user to gain illegitimate access. There exist methods in literature addressing this issue. This paper presents an analysis of masquerade detection algorithms in face recognition system.

The Windows-Users and -Intruder simulations Logs dataset (WUIL): An experimental framework for masquerade detection mechanisms

We introduce a new masquerade dataset, called Windows-Users and -Intruder simulations Logs (WUIL), which, unlike existing datasets, involves more faithful masquerade attempts. While building WUIL, we have worked under the hypothesis that the way in which a user navigates her file system structure can neatly separate a masquerade attack. Thus, departing from standard practice, we state that it is not a user action, but the object upon which the action is carried out what distinguishes user participation. We shall argue that this approach, based on file system navigation provides a richer means, and at a higher-level of abstraction, for building novel models for masquerade detection.We shall devote an important part of this paper to describe WUIL’s content: what information about user activity is stored and how it is represented; prominent characteristics of the participant users; the kinds of masquerade attacks to be timely detected; and the way they have been simulated. We shall argue that WUIL provides reliable data for experimenting on close to real-life instances of masquerade detection, as well as for conducting fair comparisons on rival detection mechanisms, hoping it will be of use to the research community.As a side contribution of this paper, we use WUIL to conduct a simple comparison of two masquerade detection methods: one based on SVM, and the other based on KNN. While this comparison experiment is not central to the paper, we expect it to motivate research exploring deeper the masquerade detection problem, and spreading the use of WUIL. In a similar vein, we provide directions for further research, hinting on how to use the features contained in WUIL, and hoping others would find them appealing.

A variable-length model for masquerade detection

Masquerade detection is now one of the major concerns of system security research and its difficulty is to model user behavior on the nonstationary audit data. Many previous works represent the user behavior based on fixed-length models. In this paper, we propose a variable-length model to overcome their weakness in the precision and adaptability of user profiling. In the model, the user's normal behavior is profiled by Markov chain with states of variable-length sequences. At first multiple shell command streams of different lengths are generated and different shell command sequences are hierarchically merged into several sets to form the library of general sequences. Then the variable-length behavioral patterns of a valid user are mined and the Markov chain is constructed. While performing detection, the probabilities of short state sequences are calculated, smoothed with sliding windows, and finally used to classify the monitored user's activity as normal or abnormal. Our experiments with standard datasets such as Purdue data and SEA data reveal that the proposed model can achieve higher detection accuracy, require less memory and take shorter time than the other traditional methods and is amenable for real-time intrusion detection.