Masquerade Detection Using String Kernels

In the field of computer security, one of the most serious threats is masquerade attack, in which an attacker uses a legitimate user´s account in system. In this paper, we propose a new method for masquerade detection based on string kernel. String kernel is an inner product in the feature space generated by all subsequences of length k. By using string kernel, OCSVM (one-class support vector machine) algorithm can directly process the UNIX command sequences, which are the input data of masquerade detection. Experimental comparisons of the performance of our method with previous work show the following results: For PU dataset, the detection rate of our method is improved by 15% compared with the other unsupervised methods, given the same false positive rate; For SEA dataset, our method can achieve about the same detection rate as the best supervised method; Compared with the RBF-OCSVM, our detection rate is improved by about 13%.