Masquerade detection based on SVM and sequence-based user commands profile

  • Authors:
  • Jeongseok Seo;Sungdeok Cha

  • Affiliations:
  • Republic of Korea;Republic of Korea

  • Venue:
  • ASIACCS '07 Proceedings of the 2nd ACM symposium on Information, computer and communications security
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

Masqueraders, despite widespread use of security products such as firewalls and intrusion detection systems, are serious threats to organizations. Although anomaly detection techniques have been considered as an effective approach to complement existing security solutions, they are not widely used in practice due to poor accuracy and relatively high degree of false alarms. In this paper, we performed an empirical study investigating the effectiveness of SVM and sequence-based kernel methods. Sequence-based kernel methods showed slightly better performance than generic RBF kernel with same frequency of false alarms. In addition, the composition of two kernel methods showed that frequency of false alarms could be further reduced.