Using identity credential usage logs to detect anomalous service accesses

For e-commerce companies providing online services, fraudulent access resulting from theft of identity credentials is a serious concern. Such online service providers deploy a variety of defenses and invest significant time and effort to the analysis of a large amount of log data to detect malicious activities and their impact. To reduce this burden, we explore the effectiveness of an anomaly detection based approach that relies on identity credential usage log records. More specifically, we use an anomaly-based metric to score the risk of each identity credential usage, e.g., a login request. Scores are determined based on categorical attribute values extracted from log records, such as timestamps. We utilize actual log data of login attempts to a university portal to evaluate the effectiveness of this approach. Our approach can work in conjunction with intrusion or fraud detection systems. It is also possible that stronger authentication can be required only when the risk score...

• Type: Conference
• Year: 2009
• Where: DIM
• Authors: Daisuke Mashima, Mustaque Ahamad
• Keywords: DIM 2009, Identity Credential, Identity Credential Usage, Log Records