A Study of Effectiveness in Masquerade Detection

Masquerade detection is the ability to detect attackers known as masqueraders that intrude on another user’s system and pose as legitimate users. Once a masquerader obtains access to a user’s system, the masquerader has free reign over whatever data is on that system. In this research, we focus on masquerade detection and user classi cation using the following two di erent approaches: the heavy hitter approach and 2 di erent approaches based on hidden Markov models (HMMs), the dueling-HMM and threshold-HMM strategies. The heavy hitter approach computes the frequent elements seen in the training data sequence and test data sequence and computes the distance to see whether the test data sequence is masqueraded or not. The results show very misleading classi cations, suggesting that the approach is not viable for masquerade detection. A hidden Markov model is a tool for representing probability distributions over sequences of observations [9]. Previous research has shown that using a threshold-based hidden Markov model (HMM) approach is successful in a variety of categories: malware detection, intrusion detection, pattern recognition, etc. We have veri ed that using a threshold-based HMM approach produces high accuracy with low amounts of a false positives. Using the dueling- HMM approach, which utilizes multiple training HMMs, we obtain an overall accuracy of 81.96%. With the introduction of the bias in the dueling-HMM approach, we produce similar results to the results obtained in the threshold-based HMM approach, where we see many non-masqueraded data detected, while many masqueraded data avoid detection, yet still result in an high overall accuracy.

A masquerade attack, in which an attacker impersonates a legitimate user to utilize the user's privileges, can be triggered either by someone within the organization or by an outsider. We propose the sequence alignment based hidden Markov model (SA-HMM) approach, where we incorporate the benefits of both the sequence alignment and continuous hidden Markov model (HMM). The sequence alignment module for the proposed algorithm allows the algorithm to tolerate variations in user activity sequence. The HMM module takes the positional information between the observations of users into account. The proposed approach achieves a high hit ratio of 94.1% outperforming existing masquerade detection approaches.

In the UNIX/Linux environment the kernel can log every command process created by every user with process accounting. Thus process accounting logs have many potential uses, particularly the monitoring and forensic investigation of security events. Previous work successfully leveraged the use of process accounting logs to identify a difficult to detect and damaging intrusions within high performance computing (HPC) clusters, masquerade attacks, where intruders pose as legitimate users with purloined authentication credentials. This paper incrementally advances the goal of more accurately identifying masqueraders on HPC clusters by seeking to identify features within command sets that distinguish masqueraders. To accomplish this goal, we created NVision-PA, a software tool which produces text and graphic statistical summaries describing input processing accounting logs. This research is both a promising next step toward creating a real-time masquerade detection sensor for production HPC clusters as well as providing another tool for system administrators to use for statistically monitoring and managing legitimate workloads in HPC environments

In this paper, a novel recursive data mining method based on the simple but powerful model of cognition called a conceptor is introduced and applied to computer security. The method recursively mines a string of symbols by finding frequent patterns, encoding them with unique symbols and rewriting the string using this new coding. We apply this technique to two related but important problems in computer security: (i) masquerade detection to prevent a security attack in which an intruder impersonates a legitimate user to gain access to the resources, and (ii) author identification, in which anonymous or disputed computer session needs to be attributed to one of a set of potential authors. Many methods based on automata theory, hidden Markov models, Bayesian models or even matching algorithms from bioinformatics have been proposed to solve the masquerading detection problem but less work has been done on the author identification. We used recursive data mining to characterize the structure and high-level symbols in user signatures and the monitored sessions. We used one-class SVM to measure the similarity of these two characterizations. We applied weighting prediction scheme to author identification. On the SEA dataset that we used in our experiments, the results were very promising.

In this paper, we consider the problem of masquerade detection based on a UNIX system. A masquerader is an intruder who tries to remain undetected by impersonating a legitimate user. Masquerade detection is a special case of the general intrusion detection problem. We have collected data from a large number of users. This data includes infor- mation on user commands and a variety of other aspects of user behavior that can be used to construct a profile of a given user. Hidden Markov models have been used to train user profiles, and the various attack strategies have been analyzed. The results are compared to a standard dataset that offers a more limited view of user behavior.

Management, Information Systems and Computers: An Introduction: by Roy Anderson. Published by Macmillan 282 pp. £16.00

The most important challenge of the spectrum sensing in cognitive radio (CR) is to find a way to share the licensed spectrum without interfering with the licensed user transmission. Predicting the near future of the licensed or primary user (PU) channel state can solve this problem. Many studies have investigated the primary user channel state prediction in recent literature, in this study we introduce new approach for PU channel state prediction in time domain based on hidden Markov model (HMM) and Markov switching model (MSM). In our new approach we use a time series to capture the primary user channel state detection sequence (PU channel “idle” or “occupied”). Then, we fed this time series as an observation sequence into HMM and MSM algorithm to predict the switching time between the two states, “idle and occupied” before it happens so that the secondary user (SU) can adjust its transmission strategies accordingly. The experimental results show that all HMM and MSM perform very well for PU channel state prediction. It has also shown in a simulation comparison between HMM and MSM algorithm that MSM algorithm can preform without need for training process and provide a smoother prediction with low computational complexity than HMM.

Spectrum prediction plays a critical role in cognitive radio networks because it is promising to significantly speed up the sensing process and hence save energy as well as improve resource utilization. However, most existing spectrum prediction models are not able to fully explore the hidden correlation among adjacent observations or appropriately describe the channel behavior. In this paper, we propose a novel prediction approach termed high-order hidden bivariate Markov model (H^2BMM), by leveraging the advantages of both HBMM and high-order. H^2BMM applies two dimensional parameters, i.e., hidden process and underlying process, to more accurately describe the channel behavior. In addition, the current channel state is predicted by observing multiple previous states. Extensive simulations are conducted and results verify that the prediction accuracy is significantly improved using the proposed H^2BMM compared with traditional Hidden Markov Model (HMM) and Hidden Bivariate Markov Model (HBMM).

Survey of Models A Survey of Models for Discrete-Valued Time Series Introduction: The Need for Discrete-Valued Time Series Models Markov Chains Higher-Order Markov Chains The DARMA models of Jacobs and Lewis Models Based on Thinning The Bivariate Geometric Models of Block, Langberg, and Stoffer Markov Regression Models Parameter-Driven Models State-Spaced Models Miscellaneous Models Discussion Hidden Markov Models The Basic Models Introduction Some Theoretical Aspects of Hidden Markov Models in Speech Processing Hidden Markov Time Series Models: Definition and Notation Correlation Properties Evaluation of the Likelihood Function Distributional Properties Parameter Estimation Identification of Outliers Reversibility Discussion Extensions and Modifications Introduction Models Based on a Second-Order Markov Chain Multinomial-Hidden Markov Models Multivariate Models Models with State-Dependent Probabilities Depending on Covariates Models in Which th e Markov Chain Is Homogeneous but Not Assumed Stationary Models in Which the Markov Chain Is Nonhomogeneous Joint Models for the Numbers of Trials and the Numbers of Successes in Those Trials Discussion Applications Introduction The Durations of Successive Eruptions of the Old Faithful Geyser Epileptic Seizure Counts Births at Edendale Hospital Locomotory Behaviour of Locusta migratoria Wind Direction at Koeberg Evapotranspiration Thinly Traded Shares on the Johannesburt Stock Exchange Daily Rainfall at Durban Homicides and Suicides, Cape Town, 1986-1991 Conclusion Appendices A : Proofs of Results Used in the Derivation of the Baum-Welch Algorithm B: Data

Automatic Guided Vehicle (AGV) semantic attack is now becoming an important research topic in digital workshops. Unfortunately, the conventional attack detections could trigger the wrong attack detection alarms, because of the unexpected wireless radio frequency interference. This paper investigates a new method for AGV semantic attack detection based on Hidden Markov Model (HMM). Our method is able to discriminate the typical wireless retransmission in presence of environment interference or in the context of AGV semantic attack by comparing the hidden state transition probability with the predefined threshold. Our model has been evaluated on our developed platform. The extensive experimental results and analysis prove the effectiveness of our method.

An approach to user modelling with discrete stochastic processes is presented, which aims at the dynamic individualization of user interfaces on the syntactic layer. The state of the art of syntactic user modelling is surveyed. The mathematical background of simple Markov Chains and the 'classic' Hidden Markov Model is presented. Furthermore, dynamic Bayesian Networks are introduced, which generalize these Markovian Models. A case study of the simulation experiments uses a multimodal user interface for supervisory control of advanced manufacturing cells. A corresponding simulation model is created and exploited to generate interaction cases, which are the empirical basis for the evaluation. Six topologies of dynamic Bayesian Networks are evaluated for 100 interaction cases and 50 replications each: (1) Markov Chain of order 1, (2) Hidden Markov Model, (3) autoregressive Hidden Markov Model, (4) factorial Hidden Markov Model, (5) simple hierarchical Hidden Markov Model, and (6) tree structured Hidden Markov Model. The dependent variable is the prediction accuracy for a single prediction lead. In a first step, a one-way analysis of variance in conjunction with Tukey's post-hoc test demonstrated a significant superiority of the simple hierarchical Hidden Markov Model. In a second step, an additional two-way analysis of variance also indicated a significantly better prediction accuracy of the simple hierarchical Hidden Markov Model compared to the Hidden Markov Model, but the number of interaction cases also had a significant effect. Hence, the modeller has to take both factors--model topology and number of interaction cases--into account when designing syntactic user models with stochastic processes.

Biometric systems such as fingerprint, iris, DNA became popular methods in user authentication. Compared to these biometric systems, keystroke biometric authentication systems have not gained so much attention because of lower accuracy compared to other biometric systems. A number of researches have been conducted on keystroke biometric using different generative and discriminative classifiers. As Hidden Markov Models have proven a great success in voice recognition, this study investigates Hidden Markov Models in keystroke dynamic. This paper proposes a novel user verification technique using 1-substate Hidden Markov Model through keystroke dynamic. To verify the effectiveness of the proposed system, extensive experiments have been conducted and 80% accuracy was achieved by the proposed system.

This paper is concerned with filtering of hidden Markov processes (HMP) which possess (or approximately possess) the property of lumpability. This property is a generalization of the property of lumpability of a Markov chain which has been previously addressed by others. In essence, the property of lumpability means that there is a partition of the (atomic) states of the Markov chain into aggregated sets which act in a similar manner as far as the state dynamics and observation statistics are concerned. We prove necessary and sufficient conditions on the HMP for exact lumpability to hold. For a particular class of hidden Markov models (HMM), namely finite output alphabet models, conditions for lumpability of all HMP representable by a specified HMM are given. The corresponding optimal filter algorithms for the aggregated states are then derived. The paper also describes an approach to efficient suboptimal filtering for HMP which are approximately lumpable. By this we mean that the HMM generating the process may be approximated by a lumpable HMM. This approach involves directly finding a lumped HMM which approximates the original HMM well, in a matrix norm sense. An alternative approach for model reduction based on approximating a given HMM by an exactly lumpable HMM is also derived. This method is based on the alternating convex projections algorithm. Some simulation examples are presented which illustrate the performance of the suboptimal filtering algorithms.

SummaryThe rapidly growing cloud computing paradigm provides a cost‐effective platform for storing, sharing, and delivering data and computation through internet connectivity. However, one of the biggest barriers for massive cloud adoption is the growing cybersecurity threats/risks that influence its confidence and feasibility. Existing threat models for clouds may not be able to capture complex attacks. For example, an attacker may combine multiple security vulnerabilities into an intelligent, persistent, and sequence of attack behaviors that will continuously act to compromise the target on clouds. Hence, new models for detection of complex and diversified network attacks are needed. In this article, we introduce an effective threat modeling approach that has the ability to predict and detect the probability of occurrence of various security threats and attacks within the cloud environment using hidden Markov models (HMMs). The HMM is a powerful statistical analysis technique and is used to create a probability matrix based on the sensitivity of the data and possible system components that can be attacked. In addition, the HMM is used to provide supplemental information to discover a trend attack pattern from the implicit (or hidden) raw data. The proposed model is trained to identify anomalous sequences or threats so that accurate and up‐to‐date information on risk exposure of cloud‐hosted services are properly detected. The proposed model would act as an underlying framework and a guiding tool for cloud systems security experts and administrators to secure processes and services over the cloud. The performance evaluation shows the effectiveness of the proposed approach to find attack probability and the number of correctly detected attacks in the presence of multiple attack scenarios.

Prediction of 24-hour-average PM2.5 concentrations using a hidden Markov model with different emission distributions in Northern California