Experimenting with masquerade detection via user task usage

Rodríguez, Jorge; Cañete, Leonardo; Monroy, Raúl; Medina‐Pérez, Miguel Angel

doi:10.1007/s12008-016-0360-1

Cited by 5 publications

(4 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this work, we have tested our proposed method on the masquerade detection domain. Some examples of work in this domain are Maxion and Townsend (), Maxion (), Camiña et al (), Medina‐Pérez et al (), and Rodríguez et al (). In masquerade detection, it is easy to sample objects from the normal interaction between a user and his PC.…”

Section: Related Workmentioning

confidence: 99%

“…Masquerade detection refers to detecting whether a given activity in a computing device is done by a legitimate device user (Rodríguez et al, ). This problem, along with other anomaly detection scenarios, can be approached as a one‐class classification problem.…”

Section: Experimental Setup: a Masquerade Detection Settingmentioning

confidence: 99%

“…Our experiments focus on detecting when an intruder is posing as the legitimate user of a system, called masquerade detection (Rodríguez et al, ). This context is usually taken as a one‐class classification problem because it is easy to obtain data from a person or user of a system; however, obtaining objects that represent anomalies cannot be easily done without causing harm or inconvenience to the person, and the number of different anomalies might complicate obtaining a training set that correctly represents the anomalous class.…”

Section: Experimental Setup: a Masquerade Detection Settingmentioning

confidence: 99%

“…We defined m =100 as the maximum number of clusters because that is the number used in the experiments done to test VIC (Rodríguez et al, ). Furthermore, a previous study (Rodríguez et al, ) on the WUIL data set determined that clustering‐based classifiers usually perform better when the number of groups used is below 100.…”

Section: Experimental Setup: a Masquerade Detection Settingmentioning

confidence: 99%

See 3 more Smart Citations

Cluster validation in clustering‐based one‐class classification

Rodríguez¹,

Monroy²,

Medina‐Pérez³

et al. 2019

Expert Systems

Self Cite

View full text Add to dashboard Cite

Reconstruction‐based one‐class classification has shown to be very effective in a number of domains. This approach works by attempting to capture the underlying structure of the normal class, typically, by means of clusters of objects. It has the main disadvantage, however, that one has to indicate the number of clusters in advance, for this yields an efficient way of computing a clustering. In this paper, we introduce a new algorithm, OCKRA++, which achieves a better performance, by enhancing a clustering‐based one‐class ensemble classifier (OCKRA) with a cluster validity index that is used to set the best number of clusters during the classifier's training process. We have thoroughly tested OCKRA++ in a particular domain, namely masquerade detection. For this purpose, we have used the Windows‐Users and ‐Intruder simulation Logs data set repository, which contains 70 different masquerade data sets. We have found that OCKRA++ is currently the algorithm that achieves the best area under the curve, with a significant difference, in masquerade detection using the file system navigation approach.

show abstract