Citation Context

...s. 3) A masquerader may happen to have similar behavioral patterns as the legitimate user, therefore it can escape detection and successfully cause damage under the cover of seemingly normal behavior =-=[4]-=-.International Journal of Network Security, Vol.8, No.3, PP.201–210, May 2009 202 Fortunately, there have been several attempts to tackle the problem of detecting masqueraders. Several masquerade-det...

Citation Context

... which they called the “1v49”sexperiment, in order to conduct this error analysis.sA method, that is significantly different from othersintrusion detection technologies, was presented bysCoull et al. =-=[11]-=-. The method is known as semiglobal alignment and is a modification of the SmithWaterman local alignment algorithm, with a scoringssystem that rewards the alignment of commands insthe user segment but...

Citation Context

... which they called the “1v49”sexperiment, in order to conduct this error analysis.sA method, that is significantly different from othersintrusion detection technologies, was presented bysCoull et al. =-=[11]-=-. The method is known as semiglobal alignment and is a modification of the SmithWaterman local alignment algorithm, with a scoringssystem that rewards the alignment of commands insthe user segment but...

Citation Context

... the 10 most recent commands and a user’s profile. But this approach is not suitable for cloud infrastructure because cloud systems are heterogeneous systems [9, 10]. Here the virtual machines which form cloud systems are executes under the different operating systems (Windows, Linux, UNIX, Network). It is also likely that different commands are used for the same operation. For this reason, it is impossible to evaluate similar users by their command sequence. In the other approach a sequence alignment method, which is broadly used in bioinformatics, is applied to discover the illegal accesses [11, 12]. As it can be seen most of the studies are focused on the detection of unusual or variable command sequence applied by the users. Generally, the legitimate users of the computer system 88 User Profiles and Identifing User Behaviour in the Cloud Computing Environment are familiar with the files on that system and are aware of their location. Any search for the specific files is likely to be targeted and limited here. A masquerader, however, who gets access to the victim’s system illegitimately is unlikely to be familiar with the structure and the contents of the file system. For this, his sear...

Citation Context

...tem calls (Forrest et al., 1996), and data mining of system audit data (Lee and Stolfo, 2000). Some recent work on anomaly detection applies principles and concepts borrowed from biological sciences (=-=Coull et al., 2003-=-; Burgess, 1998; Forrest et al., 1996; Forrest et al., 1997). In particular some ap-proaches are inspired by immunology, as in (Forrest et al., 1996) where system calls are analyzed to infer anomalou...

Citation Context

...g before crossing the 1% false positive boundary. Wang [19] used oneclass training based on data representative of only one user and demonstrated that it worked as well as multi-class training. Coull =-=[4]-=- applied bioinformatics matching algorithm for a semi-global alignment to this problem. Lee [12] built a data mining framework for constructing features and model for intrusion detection. Roy Maxion c...

Citation Context

...Though this assumption is unrealistic in the case of masquerades, the Naïve Bayes technique still gives better results than the previously mentioned six techniques [4–6,8,13,14]. Recently, Coull etal =-=[2]-=- proposed a technique based on bioinformatics matching algorithm for a semi-global alignment. Wang [17] used one-class training without using examples from other users and demonstrated that it can ach...