Abstract-In this paper, a novel recursive data mining method based on the simple but powerful model of cognition called a conceptor ;s introduced and applied to computer security. The method recursively mines a string of symbols by finding frequent patterns, encoding them with unique symbols and rewriting the string using this new coding. We apply this technique to two related but important problems in computer security: (i) masquerade detection to prevent a security attack in which an intruder impersonates a legitimate user to gain access to the resources, and (ii) author identification, in which anonymous or disputed computer session needs to be attributed to one of a set of potential authors. Many methods based on automata theory, Hidden Markov Models, Bayesian models or even matching algorithms from bioinformatics have been proposed to solve the masquerading detection problem but less work has been done on the author identification. We used recursive data mining to characterize the structure and high-level symbols in user signatures and the monitored sessions. We used one-class SVM to measure the similarity o/these two characterizations. We applied weighting prediction scheme to Guthor identification. On the SEA dataset that we used in our experiments, the results were very promising.
To find frequent patterns, Szymanski and Zhang REF proposed recursive mining, encoded the patterns with unique symbols, and rewrote the sequence using this new coding.
Recursive data mining for masquerade detection and author identification
Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.
Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.
Computer Science