Computer Intrusion: Detecting Masquerades

Masqueraders in computer intrusion detection are people who use somebody else's computer account. We investigate a number of statistical approaches for detecting masqueraders. To evaluate them, we collected UNIX command data from 50 users and then contaminated the data with masqueraders. The ex...

Full description

Saved in:
Bibliographic Details
Published in:Statistical science 2001-02, Vol.16 (1), p.58-74
Main Authors: Schonlau, Matthias, DuMouchel, William, Ju, Wen-Hua, Karr, Alan F., Theus, Martin, Vardi, Yehuda
Format: Article
Language:English
Subjects:
anomaly
Bayes
compression
Computer science
computer security
Datasets
False alarms
high­order Markov
Intrusion detection systems
Markov models
Masquerades
Pattern recognition
profiling
Test data
Transition probabilities
Uniqueness
Unix
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Masqueraders in computer intrusion detection are people who use somebody else's computer account. We investigate a number of statistical approaches for detecting masqueraders. To evaluate them, we collected UNIX command data from 50 users and then contaminated the data with masqueraders. The experiment was blinded. We show results from six methods, including two approaches from the computer science community.
ISSN:0883-4237
2168-8745
DOI:10.1214/ss/998929476