A masquerade detecting method based on the TF-IDF model (情報セキュリティ)

概要

論文の詳細を見る
Masquerade is someone who impersonates another user and operates computer system with privileged access. Computer security caused by masquerade is in a serious situation. Many researches have been proposed from different viewpoints. For the variability of user behavior and the similarity between the behavior of masquerade and that of normal user, it's difficult to gain a satisfy detection efficiency. Especially, these researches conducted their experiments on the benchmark datasets of Unix command sequence, so that efficiency of different methods could be compared. In this study, we proposed to apply the Term Frequency/Inverse Document Frequency (TF-IDF) model, which has been widely used in text classification in Natural Language Processing (NLP), to masquerade detection. Command was treated as word, and session was treated as paragraph. Therefore, the classification problem between normal and masquerade could be looked as the classification of text. A new formula of TF-IDF was proposed, and a ranking scheme was also further presented to improve detection efficiency. Experiment was conducted on a benchmark data, and experimental results show that it reports better detection efficiency than that of the previous Uniqueness method. Though, only the characteristic of command frequency is considered at the moment, it gains an encouraging detection efficiency. A better efficiency is expected to be gained in future research by updating.
2008-12-10