Intruder detection
 | This article needs more citations. (August 2026) |
In information security, intruder detection is the process of detecting intruders behind attacks as unique persons, rather than just detecting that an attack has occurred. This technique tries to identify the person behind an attack by analyzing their computational behaviour. It is similar to masquerade detection, the process of recognising an illegitimate user who is attempting to impersonate a legitimate one.[1]
History
[edit]Early work focused on detecting a masquerader based on the sequence of commands they entered in a UNIX shell. Schonlau and his colleagues compared six different statistical approaches to this problem, later releasing a command-history dataset that was used as a benchmark for later research.[2]
The Si6 information security laboratory performed a research project which was aimed at developing a computer intruder identification system that was based upon the behaviour of remote intruders, utilizing behavioural biometric techniques applied to host parameters and networking parameters.[1] Project members went on to test Schonlau's argument that more rarely used commands are the most useful for identifying a user, but did not find any conclusive evidence for it, instead finding that restricting a detection algorithm in this way degraded accuracy more than commands selected at random.[3]
Theory
[edit]Intruder Detection Systems try to detect who is attacking a system by analyzing their computational behaviour or biometric behaviour.[1]
Some of the parameters used to identify a intruder
[edit]Host-side parameters can include:[1]
- Keystroke dynamics (also known as keystroke patterns, typing pattern, or typing behaviour)
- Patterns such as the commands used, the sequence in which they are used, the directories accessed, or the mistakes made
Network-side parameters include:[1]
- The IP address used, as well as the routers traversed
- The operating system used in the attack, which in some cases can be derived from the header fields of TCP/IP packets[4]
Keystroke dynamics
[edit]Keystroke dynamics is paramount in Intruder Detection techniques because it is the only parameter that has been classified as a real 'behavioural biometric pattern'.
Keystroke dynamics analyze times between keystrokes issued in a computer keyboard or cellular phone keypad searching for patterns. First techniques used statistics and probability concepts like 'standard deviations' and 'Mean', later approaches use data mining, neural networks, Support Vector Machine, etc.
See also
[edit]References
[edit]- 1 2 3 4 5 Bertacchini, Maximiliano; Fierens, Pablo I. (2007). "Preliminary Results on Masquerader Detection using Compression Based Similarity Metrics". Electronic Journal of SADIO. 7 (1): 31–42.
- ↑ Schonlau, Matthias; DuMouchel, William; Ju, Wen-Hua; Karr, Alan F.; Theus, Martin; Vardi, Yehuda (2001). "Computer Intrusion: Detecting Masquerades". Statistical Science. 16 (1): 58–74. doi:10.1214/ss/998929476.
- ↑ Benitez, Carlos; Fierens, Pablo I. (2009). "Experiments on command dimension reduction in masquerader detection" (PDF). Actas del V Congreso Iberoamericano de Seguridad Informática (CIBSI'09). Montevideo, Uruguay: Universidad de la República. pp. 31–45.
- ↑ Lippmann, Richard P.; Fried, David J.; Piwowarski, Keith J.; Streilein, William W. (19 November 2003). "Passive Operating System Identification from TCP/IP Packet Headers". Proceedings of the ICDM Workshop on Data Mining for Computer Security (DMSEC). Melbourne, Florida.
External links
[edit]- P0f OS fingerprinting tool
- Si6 Paranoid Project Archived 2005-12-01 at the Wayback Machine