Sciweavers

PAKDD
2004
ACM

Using Self-Consistent Naive-Bayes to Detect Masquerades

14 years 4 months ago
Using Self-Consistent Naive-Bayes to Detect Masquerades
To gain access to account privileges, an intruder masquerades as the proper account user. This paper proposes a new strategy for detecting masquerades in a multiuser system. To detect masquerading sessions, one profile of command usage is built from the sessions of the proper user, and a second profile is built from the sessions of the remaining known users. The sequence of the commands in the sessions is reduced to a histogram of commands, and the naive-Bayes classifier is used to decide the identity of new incoming sessions. The standard naive-Bayes classifier is extended to take advantage of information from new unidentified sessions. On the basis of the current profiles, a newly presented session is first assigned a probability of being a masquerading session, and then the profiles are updated to reflect the new session. As prescribed by the expectation-maximization algorithm, this procedure is iterated until the probabilities and the profiles are consistent. Experiments ...
Kwong H. Yung
Added 02 Jul 2010
Updated 02 Jul 2010
Type Conference
Year 2004
Where PAKDD
Authors Kwong H. Yung
Comments (0)