RACOON: Rapidly Generating User Command Data For Anomaly Detection From Customizable Templates

Authors:
Ramkumar Chinchani;Aarthie Muthukrishnan;Madhusudhanan Chandrasekaran;Shambhu Upadhyaya
Affiliations:
State University of New York at Buffalo;State University of New York at Buffalo;State University of New York at Buffalo;State University of New York at Buffalo
Venue:
ACSAC '04 Proceedings of the 20th Annual Computer Security Applications Conference
Year:
2004

Citing 0
Cited 6

USim: A User Behavior Simulation Framework for Training and Testing IDSes in GUI Based Systems

ANSS '06 Proceedings of the 39th annual Symposium on Simulation
Strategy-based behavioural biometrics: a novel approach to automated identification

International Journal of Computer Applications in Technology
Towards building a masquerade detection method based on user file system navigation

MICAI'11 Proceedings of the 10th Mexican international conference on Advances in Artificial Intelligence - Volume Part I
Episode based masquerade detection

ICISS'05 Proceedings of the First international conference on Information Systems Security
Masquerade attacks based on user's profile

Journal of Systems and Software
The Windows-Users and -Intruder simulations Logs dataset (WUIL): An experimental framework for masquerade detection mechanisms

Expert Systems with Applications: An International Journal

Quantified Score

Hi-index	0.00

Visualization

Abstract

One of the biggest obstacles faced by user command based anomaly detection techniques is the paucity of data. Gathering command data is a slow process often spanning months or years. In this paper, we propose an approach for data generation based on customizable templates, where each template represents a particular user profile. These templates can either be user-defined or created from known data sets. We have developed an automated tool called RACOON, which rapidly generates large amounts of user command data from a given template. We demonstrate that our technique can produce realistic data by showing that it passes several statistical similarity tests with real data. Our approach offers significant advantages over passive data collection in terms of being non-intrusive and enabling rapid generation of site-specific data. Finally, we report the benchmark results of some well-known algorithms against an original data set and a generated data set.