By the same authors

Information-Theoretic Detection of Masquerade Mimicry Attacks

Research output: Contribution to conferencePaper

Published copy (DOI)

Author(s)

Department/unit(s)

Publication details

DatePublished - 1 Sep 2010
Number of pages7
Original languageEnglish

Abstract

In a masquerade attack, an adversary who has stolen a legitimate user's credentials attempts to impersonate him to carry out malicious actions. Automatic detection of such attacks is often undertaken constructing models of normal behaviour of each user and then measuring significant departures from them. One potential vulnerability of this approach is that anomaly detection algorithms are generally susceptible of being deceived. In this paper, we first investigate how a resourceful masquerader can successfully evade detection while still accomplishing his goals. We then propose an algorithm based on the Kullback-Leibler divergence which attempts to identify if a sufficiently anomalous attack is present within an apparently normal request. Our experimental results indicate that the proposed scheme achieves considerably better detection quality than adversarial-unaware approaches.

    Research areas

  • Kullback-Leibler divergence, automatic malicious attack detection, masquerade mimicry attack, entropy, probability, security of data

Discover related content

Find related publications, people, projects, datasets and more using interactive charts.

View graph of relations