Bagging-TPMiner: a classifier ensemble for masquerader detection based on typical objects
详细信息 查看全文
- 作者：Miguel Angel Medina-Pérez ; Raúl Monroy ; J. Benito Camiña…
- 关键词：One ; class classifier ; Classifier ensemble ; Masquerader detection
- 刊名：Soft Computing
- 出版年：2017
- 出版时间：February 2017
- 年：2017
- 卷：21
- 期：3
- 页码：557-569
- 全文大小：
- 刊物类别：Engineering
- 刊物主题：Computational Intelligence; Artificial Intelligence (incl. Robotics); Mathematical Logic and Foundations; Control, Robotics, Mechatronics;
- 出版者：Springer Berlin Heidelberg
- ISSN：1433-7479
- 卷排序：21
文摘
The goal of a masquerade detection system is to determine whether a given computer activity does not correspond to a target user, thereby inferring that a masquerader has stolen the computer session of a user. Masquerade detection should be addressed as a one-class classification problem, where only user information is available for classifier construction. This might be mandatory when it is difficult to account for all types of attack patterns or collect enough evidence thereof. In this paper, we introduce a masquerader detection method, named Bagging-TPMiner, a one-class classifier ensemble. As the name suggests, Bagging-TPMiner bootstraps the training dataset of genuine user behavior in order to find typical objects. In the classification phase, it renders a new sample of computer behavior to be a masquerade if that behavior is distinct from the typical objects. Critically, unlike existing clustering techniques, Bagging-TPMiner gives similar attention to both types of regions, dense and sparse, thus capturing the (hidden) structure of ordinary user behavior. We have successfully tested Bagging-TPMiner on WUIL, a repository of datasets for masquerader detection that contain more faithful masquerade attempts. Our experimental results show that Bagging-TPMiner improves classification accuracy when compared to other classifiers and that it is significantly better at identifying bursts of attacks, called persistent attacks, or at continuously updating from prior mistakes.