Sequence alignment for masquerade detection
Sequence alignment for masquerade detection
复制标题
DOI：
10.1016/j.csda.2008.01.022
复制
发表时间：
2008-04
期刊：
影响因子：
--
通讯作者：
Scott E. Coull;B. Szymański
中科院分区：
文献类型：
--
作者：
Scott E. Coull;B. Szymański
伪装攻击是指攻击者冒充合法用户的身份，恶意利用该用户的权限，对信息系统的安全构成严重威胁。此类攻击完全破坏了传统的安全机制，因为一旦用户帐户经过身份验证，就会被赋予信任。已经进行了许多尝试来检测这些攻击，但实现高水平的准确性仍然是一个公开的挑战。在本文中，我们讨论了使用一个特别调整的序列比对算法，通常用于生物信息学，检测计算机审计数据序列中的伪装的实例。通过使用比对算法来将所监视的审计数据的序列与已知已经由用户产生的序列进行比对，比对算法可以发现相似性区域并且导出指示伪装攻击的存在或不存在的度量。此外，我们提出了几个评分系统，适应用户行为的变化的方法，并减少算法的计算要求的算法。我们的技术进行评估，对标准的化妆舞会检测数据集提供Schonlau等人。[Schonlau，M.，Theus，M.，2000.基于不受欢迎命令的入侵检测中伪装检测。Information Processing Letters 76（1），33-38; Schonlau，M.，DuMouchel，W.，Ju，W.H.，卡尔，A.F.，Theus，M.，瓦尔迪，Y.，2001.计算机入侵：检测伪装。Statistical Science 16（1），58-74]，并且结果表明，据我们所知，序列比对技术的使用提供了迄今为止所有伪装检测技术的最佳结果。
The masquerade attack, where an attacker takes on the identity of a legitimate user to maliciously utilize that user’s privileges, poses a serious threat to the security of information systems. Such attacks completely undermine traditional security mechanisms due to the trust imparted to user accounts once they have been authenticated. Many attempts have been made at detecting these attacks, yet achieving high levels of accuracy remains an open challenge. In this paper, we discuss the use of a specially tuned sequence alignment algorithm, typically used in bioinformatics, to detect instances of masquerading in sequences of computer audit data. By using the alignment algorithm to align sequences of monitored audit data with sequences known to have been produced by the user, the alignment algorithm can discover areas of similarity and derive a metric that indicates the presence or absence of masquerade attacks. Additionally, we present several scoring systems, methods for accommodating variations in user behavior, and heuristics for decreasing the computational requirements of the algorithm. Our technique is evaluated against the standard masquerade detection dataset provided by Schonlau et al. [Schonlau, M., Theus, M., 2000. Detecting masquerades in intrusion detection based on unpopular commands. Information Processing Letters 76 (1), 33–38; Schonlau, M., DuMouchel, W., Ju, W.H., Karr, A.F., Theus, M., Vardi, Y., 2001. Computer intrusion: Detecting masquerades. Statistical Science 16 (1), 58–74], and the results show that the use of the sequence alignment technique provides, to our knowledge, the best results of all masquerade detection techniques to date.