User monitoring through human-computer interaction

通过人机交互监控用户

• 批准号: 346428-2006
• 负责人: Traore, Issa
• 金额: $ 3.78万
• 依托单位: University of Victoria
• 依托单位国家: 加拿大
• 项目类别: Collaborative Research and Development Grants
• 财政年份: 2007
• 资助国家: 加拿大
• 起止时间: 2007-01-01 至 2008-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=362567
• 关键词: User; monitoring; through; human; computer

In recent years, several studies have emphasized the unprecedented growth in security threats from multiple and varied sources. Traditional protection mechanisms such as access control or firewalls, although valuable, have shown their limits in dealing with these threats. In this context most organizations put a particular emphasis on network forensics, which consists of investigating hacking incidents, allowing them to assess the impact of a penetration and take appropriate measures to ensure secure service continuity, and prevent future similar incidents. However, investigating computer attacks is a challenging task that usually requires analyzing a mass of diverse data. Few organizations are well equipped to tackle this challenge mainly because there are few tools accessible to organizations that will help determine the impact of hacking incidents. An important but extremely difficult aspect of network forensics is attacker profiling. This consists of maintaining and using information about the attacker himself, for instance, by identifying his operating system through passive OS fingerprinting. We propose in this project a new approach to user profiling that is based on multimodal biometrics technology for passive and dynamic user monitoring in computer networks. The proposed technology combines an enhanced form of keystroke technology and a new biometrics technology based on mouse dynamics. Our enhancement to keystroke technology consists of allowing free text detection, meaning that the user is detected dynamically based on arbitrary text inputs. Mouse dynamics biometrics involves a signature that is based on selected mouse movement characteristics, which are computed using statistical techniques such as neural networks. By allowing dynamic and passive user monitoring, the proposed technology can be used to track reliably and continuously legitimate and illegitimate users throughout computing sessions. The profiles computed in this case are more accurate since they are based on distinctive biological characteristics of users. The computed biometrics profile can be used to track an attacker throughout computing sessions, allowing identifying, easily and accurately, compromised systems within the environment. In this project, we investigate besides network forensics, many other applications of the proposed multimodal biometric technique including session security, intrusion detection, electronic signature, and multifactor authentication.

近年来，一些研究强调了来自多种来源的安全威胁前所未有的增长。传统的保护机制，如访问控制或防火墙，虽然很有价值，但在应对这些威胁方面已经显示出它们的局限性。在这种情况下，大多数组织特别重视网络取证，包括调查黑客事件，使他们能够评估入侵的影响，并采取适当措施确保安全的服务连续性，并防止未来发生类似事件。然而，调查计算机攻击是一项具有挑战性的任务，通常需要分析大量不同的数据。很少有组织能够很好地应对这一挑战，主要是因为组织可以使用的工具很少，可以帮助确定黑客事件的影响。网络取证的一个重要但极其困难的方面是攻击者特征分析。这包括维护和使用有关攻击者本人的信息，例如，通过被动操作系统指纹识别他的操作系统。在这个项目中，我们提出了一种新的基于多模式生物特征识别技术的用户特征分析方法，用于计算机网络中的被动和动态用户监控。提出的技术结合了一种增强形式的击键技术和一种基于鼠标动力学的新生物识别技术。我们对击键技术的增强包括允许自由文本检测，这意味着基于任意文本输入动态检测用户。鼠标动态生物识别涉及基于选定的鼠标运动特征的签名，这些特征是使用统计技术(如神经网络)计算的。通过允许动态和被动的用户监控，所提出的技术可以用于在整个计算会话期间可靠且持续地跟踪合法和非法用户。在这种情况下计算的配置文件更准确，因为它们基于用户独特的生物特征。计算出的生物特征文件可用于在整个计算会话期间跟踪攻击者，从而可以轻松准确地识别环境中受攻击的系统。在这个项目中，除了网络取证之外，我们还研究了所提出的多模式生物识别技术的许多其他应用，包括会话安全、入侵检测、电子签名和多因素认证。