Towards a Masquerade Detection System Based on User's Tasks
Towards a Masquerade Detection System Based on User's Tasks
复制标题
基于用户任务的伪装检测系统
DOI：
10.1007/978-3-319-11379-1_22
复制
发表时间：
2014
期刊：
影响因子：
--
通讯作者：
R. Monroy
中科院分区：
文献类型：
--
作者：
J. Camiña;Jorge Rodríguez;R. Monroy
如今，计算机存储关键信息，促进了旨在及时检测任何类型入侵的机制的发展。其中一些机制称为伪装检测器，通常被设计为在检测到系统行为异常时发出警报。通常，普通系统行为的概要文件是根据命令执行的历史记录构建的。然而，在[1，2]中，我们建议它不是一个命令，而是执行它的对象，它可以将伪装与用户参与区分开来;此外，我们假设这种方法提供了一种构建伪装检测器的方法，该检测器在更高的抽象级别上工作。在本文中，我们报告了这一假设验证的成功一步。我们抽象的关键在于，一个目录通常包含紧密相关的对象，类似于一个用户任务;因此，我们不必考虑对单个对象的访问;相反，我们简单地将其视为对它的某个祖先目录（用户任务）的访问。事实上，我们将证明，通过只查看对少数这样的用户任务的访问，我们可以构建一个伪装检测器，就像我们查看对每个文件系统对象的访问一样强大。这种抽象的优点是至关重要的：它简化了伪装检测机制的构建和维护，因为它产生了更短的模型。使用WUIL数据集[2]，我们进行了两个实验来区分两个单类分类器的性能，即：朴素贝叶斯和马尔可夫链，考虑单个对象和我们对用户任务的抽象。我们将看到，在这两种情况下，基于任务的伪装者检测器优于基于单个对象的检测器。
Nowadays, computers store critical information, prompting the development of mechanisms aimed to timely detect any kind of intrusion. Some of such mechanisms, called masquerade detectors, are often designed to signal an alarm whenever they detect an anomaly in system behavior. Usually, the profile of ordinary system behavior is built out of a history of command execution. However, in [1,2], we suggested that it is not a command, but the object upon which it is carried out what may distinguish a masquerade from user participation; also, we hypothesized that this approach provides a means for building masquerade detectors that work at a higher-level of abstraction. In this paper, we report on a successful step towards this hypothesis validation. The crux of our abstraction stems from that a directory often holds closely related objects, resembling a user task; thus, we do not have to account for the accesses to individual objects; instead, we simply take it to be an access to some ancestor directory of it, the user task. Indeed, we shall prove that by looking into the access to only a few such user tasks, we can build a masquerade detector, just as powerful as if we looked into the access to every single file system object. The advantages of this abstraction are paramount: it eases the construction and maintenance of a masquerade detection mechanism, as it yields much shorter models. Using the WUIL dataset [2], we have conducted two experiments for distinguishing the performance of two one-class classifiers, namely: Naive Bayes and Markov chains, considering single objects and our abstraction to user tasks. We shall see that in both cases, the task-based masquerader detector outperforms the individual object-based one.