User modelling for exclusion and anomaly detection : a behavioural intrusion detection system
Files
(Published version)
Date
2010
Authors
Pannell, G.
Ashman, H.
Editors
Kobsa, A.
Advisors
Journal Title
Journal ISSN
Volume Title
Type:
Book chapter
Citation
Event/exhibition information: 18th International Conference, UMAP, Hawaii, USA, 20/06/2010 - 24/06/2010
Source details - Title: User Modeling, Adaptation, and Personalization, 2010 / Kobsa, A. (ed./s), pp.207-218
Statement of Responsibility
Conference Name
Abstract
User models are generally created to personalise information or share user experiences among like-minded individuals. An individual's characteristics are compared to those of some canonical user type, and the user included in various user groups accordingly. Those user groups might be defined according to academic ability or recreational interests, but the aim is to include the user in relevant groups where appropriate. The user model described here operates on the principle of exclusion, not inclusion, and its purpose is to detect atypical behaviour, seeing if a user falls outside a category, rather than inside one. That is, it performs anomaly detection against either an individual user model or a typical user model. Such a principle can be usefully applied in many ways, such as early detection of illness, or discovering students with learning issues. In this paper, we apply the anomaly detection principle to the detection of intruders on a computer system masquerading as real users, by comparing the behaviour of the intruder with the expected behaviour of the user as characterised by their user model. This behaviour is captured in characteristics such as typing habits, Web page usage and application usage. An experimental intrusion detection system (IDS) was built with user models reflecting these characteristics, and it was found that comparison with a small number of key characteristics from a user model can very quickly detect anomalies and thus identify an intruder.
School/Discipline
Dissertation Note
Provenance
Description
Access Status
Rights
Copyright 2010 Springer-Verlag Berlin Heidelberg
Access Condition Notes: Accepted manuscript is available open access