Computer Intrusion: Detecting Masquerades

By Matthias Schonlau, William DuMouchel, Wen-Hua Ju, Alan F. Karr, Martin Theusan, Y. Vardi. 2001

444 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

A Survey of Insider Attack Detection Research (2008, methodology): “applied six masquerade detection methods to a data set of ”truncated” UNIX shell commands for 70 users [28] collected using the UNIX acct auditing mechanism.”
User re-authentication via mouse movements (2004, background): “Examples of research that utilize human generated patterns directly include systems that model normal behavior of a user’s command line input [4, 21, 26, 34, 36], keystroke dynamics [28, 37] and mouse movements [14].”
A framework for the evaluation of intrusion detection systems (2006, unknown): “Examples of x used in intrusion detection are sequences of system calls [8], sequences of user commands [ 26 ], connection attempts to local hosts [12], proportion of accesses (in terms of TCP or UDP packets) to a given port of a machine over a fixed period of time [19] etc.”
A Behavior-Based Approach to Securing Email Systems (2003, methodology): “As data with real intrusions are very difficult to obtain [19], EMT’s menu includes the creation of simulated email records in order to test and visualize the various”
Behavioural biometrics: a survey and classification (2008, background): “Data collection process is often time consuming since as many as 15,000 individual commands need to be collected for the system to achieve a high degree of accuracy (Maxion and Townsend, 2002; Schonlau et al., 2001).”