Information-Theoretic Detection of Masquerade Mimicry Attacks

Research output: Contribution to conferencePaperpeer-review


In a masquerade attack, an adversary who has stolen a legitimate user's credentials attempts to impersonate him to carry out malicious actions. Automatic detection of such attacks is often undertaken constructing models of normal behaviour of each user and then measuring significant departures from them. One potential vulnerability of this approach is that anomaly detection algorithms are generally susceptible of being deceived. In this paper, we first investigate how a resourceful masquerader can successfully evade detection while still accomplishing his goals. We then propose an algorithm based on the Kullback-Leibler divergence which attempts to identify if a sufficiently anomalous attack is present within an apparently normal request. Our experimental results indicate that the proposed scheme achieves considerably better detection quality than adversarial-unaware approaches.
Original languageEnglish
Pages183 -190
Number of pages7
Publication statusPublished - 1 Sept 2010


  • Kullback-Leibler divergence
  • automatic malicious attack detection
  • masquerade mimicry attack
  • entropy
  • probability
  • security of data

Cite this