Detecting Masqueraders Using High Frequency Commands as Signatures

Abstract

Network intruders commonly use stolen passwords or other means to log into legitimate users' computer accounts. To prevent this from happening, it is important that we are able to distinguish a user as a true user or a masquerader. Uniqueness of user command has been used in the past as signature of users. This project explores the high frequency commands to see if they work well as signatures. Experimental result was provided to show that they work as well as the Uniqueness method. Besides, the comparisons with other methods were also presented.