Towards a user network profiling for internal security using top-k rankings similarity measures

Abstract

Parres-Peredo, Álvaro I.; Piza-Dávila, Hugo I.; Cervantes, Francisco A.I. Parres-Peredo; H.I. Piza-Davila and F. Cervantes (2017). Towards a user network profiling for internal security using top-k rankings similarity measures. Abstract-A major goal of current computer network security systems is to protect the network from outside attackers; however, protecting the network from its own users is still an unattended problem. In campus area networks, the risk of having internal attacks is high because of their topologies and the amount of users. This work proposes a new approach to identify whether a network user is having or not a normal behavior, by analyzing host traffic using top-k ranking similarity measures. The result of this analysis could be an input of intrusion detection systems. The document presents an experiment where real-time traffic of different users in a campus area network is compared to a reference traffic that corresponds to one of them.

Unexpected-Behavior Detection Using TopK Rankings for Cybersecurity

“…In [17], a profiling method is proposed based on building TopK rankings of accessed services from network traffic captured at the host. Each service is represented by the 3-tuple <remote IP address, transport protocol, remote port>.…”

“…The first two phases employ the same algorithms and parameters as those used to build the user profile. The similarity is calculated using the mechanism offered by the profiling system [17], which is based on the average overlap measure [18]. Figure 7 depicts a sequence of S calculated during six hours of capturing real-time traffic of a single user.…”