Information-Theoretic Detection of Masquerade Mimicry Attacks

TY - CONF

T1 - Information-Theoretic Detection of Masquerade Mimicry Attacks

AU - Tapiador, J.E.

AU - Clark, J.A.

PY - 2010/9/1

Y1 - 2010/9/1

N2 - In a masquerade attack, an adversary who has stolen a legitimate user's credentials attempts to impersonate him to carry out malicious actions. Automatic detection of such attacks is often undertaken constructing models of normal behaviour of each user and then measuring significant departures from them. One potential vulnerability of this approach is that anomaly detection algorithms are generally susceptible of being deceived. In this paper, we first investigate how a resourceful masquerader can successfully evade detection while still accomplishing his goals. We then propose an algorithm based on the Kullback-Leibler divergence which attempts to identify if a sufficiently anomalous attack is present within an apparently normal request. Our experimental results indicate that the proposed scheme achieves considerably better detection quality than adversarial-unaware approaches.

AB - In a masquerade attack, an adversary who has stolen a legitimate user's credentials attempts to impersonate him to carry out malicious actions. Automatic detection of such attacks is often undertaken constructing models of normal behaviour of each user and then measuring significant departures from them. One potential vulnerability of this approach is that anomaly detection algorithms are generally susceptible of being deceived. In this paper, we first investigate how a resourceful masquerader can successfully evade detection while still accomplishing his goals. We then propose an algorithm based on the Kullback-Leibler divergence which attempts to identify if a sufficiently anomalous attack is present within an apparently normal request. Our experimental results indicate that the proposed scheme achieves considerably better detection quality than adversarial-unaware approaches.

KW - Kullback-Leibler divergence

KW - automatic malicious attack detection

KW - masquerade mimicry attack

KW - entropy

KW - probability

KW - security of data

UR - http://www.scopus.com/inward/record.url?scp=78650323236&partnerID=8YFLogxK

U2 - 10.1109/NSS.2010.55

DO - 10.1109/NSS.2010.55

M3 - Paper

SP - 183

EP - 190

ER -