Using gap-insensitive string kernel to detect masquerading

Authors:
Chuanhuan Yin;Shengfeng Tian;Shaomin Mu
Affiliations:
School of Computer and Information Technology, Beijing Jiaotong University, Beijing, China;School of Computer and Information Technology, Beijing Jiaotong University, Beijing, China;School of Computer and Information Technology, Beijing Jiaotong University, Beijing, China
Venue:
ADMA'05 Proceedings of the First international conference on Advanced Data Mining and Applications
Year:
2005

Citing 4
Cited 3

The nature of statistical learning theory

The nature of statistical learning theory
A fast bit-vector algorithm for approximate string matching based on dynamic programming

Journal of the ACM (JACM)
Text classification using string kernels

The Journal of Machine Learning Research
Kernel Methods for Pattern Analysis

Kernel Methods for Pattern Analysis

Efficient computations of gapped string kernels based on suffix kernel

Neurocomputing
In-the-dark network traffic classification using support vector machines

IAAI'08 Proceedings of the 20th national conference on Innovative applications of artificial intelligence - Volume 3
Predicting computer system failures using support vector machines

WASL'08 Proceedings of the First USENIX conference on Analysis of system logs

Quantified Score

Hi-index	0.00

Visualization

Abstract

Masquerade attacks may be one of the most serious attacks in computer security context. To avoid being detected, masqueraders sometimes insert some common commands such as “ls” into their command sequences intentionally for concealing their actual purpose. This causes the masquerade attacks difficult to be detected. We refer to these command sequences mixed with confusable commands as gap-insensitive. To eliminate the effects on the insertion, we present a string kernel called gap-insensitive kernel without regard to the gaps in the command sequences, and use it to detect masquerade attacks. We test it and other kernels on the dataset from keyboard commands on a UNIX platform. We find that many users' attacks against other users can be easily detected by our gap-insensitive kernel, which means that the command sequences of these attackers are gap-insensitive. The results reveal that gap-insensitive kernel can determine gap-insensitivity in command sequences, and efface the gaps in the sequences.