Learning User Models for Computer Intrusion Detection: Preliminary Results from Natural Induction Approach

Simple item page
dc.contributor.authorMichalski, Ryszard S.
dc.contributor.authorKaufman, Kenneth A.
dc.contributor.authorPietrzykowski, Jaroslaw
dc.contributor.authorŚnieżyński, Bartłomiej
dc.contributor.authorWojtusiak, Janusz
dc.date.accessioned2006-11-03T18:17:33Z
dc.date.available2006-11-03T18:17:33Z
dc.date.issued2005-11
dc.description.abstractThis paper presents a description of the LUS method for creating models (signatures) of computer users from datastreams that characterize users' interactions with computers, and the results of initial experiments with this method. By applying the models to new user activities, the system can detect an imposter, or verify a user’s legitimate activity. In this research, original datastreams are lists of records extracted from the operating system’s process table. The learned user signatures (LUS) are primarily in the reported results in the form of sets of multistate templates (MTs), each characterizing one pattern in the user’s behavior. Advantages of the method include the significant expressive power of the representation (a single template can characterize a large number of different user behaviors) and the ease of their interpretation, which makes possible their editing or enhancement by an expert. Presented initial results show a great promise and power of the method.
dc.description.sponsorshipThis research was supported in part by the UMCB/LUCITE #32 grant, and in part by the National Science Foundation under Grants No. IIS-0097476 and IIS-9906858.
dc.format.extent2757 bytes
dc.format.extent3122339 bytes
dc.format.mimetypetext/xml
dc.format.mimetypeapplication/pdf
dc.identifier.citationMichalski, R. S., Kaufman, K., Pietrzykowski, J., Śnieżyński, B. and Wojtusiak, J., "Learning User Models for Computer Intrusion Detection: Preliminary Results from Natural Induction Approach," Reports of the Machine Learning and Inference Laboratory, MLI 05-3, George Mason University, Fairfax, VA, November, 2005.
dc.identifier.urihttps://hdl.handle.net/1920/1495
dc.language.isoen_US
dc.relation.ispartofseriesP 05-6
dc.subjectIntrusion detection
dc.subjectMachine learning
dc.subjectRule learning
dc.titleLearning User Models for Computer Intrusion Detection: Preliminary Results from Natural Induction Approach
dc.typeTechnical report

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
05-06.pdf
Size:
2.98 MB
Format:
Adobe Portable Document Format
Download

Collections

Machine Learning and Inference Laboratory, College of Public Health