Abstract #301250

This is the preliminary program for the 2003 Joint Statistical Meetings in San Francisco, California. Currently included in this program is the "technical" program, schedule of invited, topic contributed, regular contributed and poster sessions; Continuing Education courses (August 2-5, 2003); and Committee and Business Meetings. This on-line program will be updated frequently to reflect the most current revisions.

To View the Program:
You may choose to view all activities of the program or just parts of it at any one time. All activities are arranged by date and time.

The views expressed here are those of the individual authors
and not necessarily those of the ASA or its board, officers, or staff.

Back to main JSM 2003 Program page
JSM 2003 Abstract #301250
Activity Number: 359
Type: Topic Contributed
Date/Time: Wednesday, August 6, 2003 : 10:30 AM to 12:20 PM
Sponsor: Section on Statistical Computing
Abstract - #301250
Title: Detecting Masquerading Users in Command Logs of Multiple Users
Author(s): Kwong H. Yung*+
Companies: Stanford University
Address: Statistics Department, Palo Alto, CA, 94305-4020,
Keywords: computer security ; intrusion detection ; anomaly detection ; masquerading user ; statistical profiling ; statistical inference
Abstract:

Command logs of computer users are recorded to thwart masquerading users. Several statistical techniques are proposed and tested on a standard dataset of user command logs. These anomaly-detection schemes reduce each user session into a histogram of commands. Several distance measures are used to compare command frequencies of two sessions, including the chi-square test and the likelihood-ratio test of classical statistical inference, the relative-entropy distance and the Kullback-Leibler distance of information theory, and the Jackard correlation and the vector-space model of information retrieval. As is typical of intrusion-detection studies, examples of masquerading sessions are not available in the training set, which consists of fifty sessions for each of fifty distinct users. Instead, sessions of each user serve as masquerading sessions for the other users. This approach proves valuable for setting alarm thresholds and choosing model parameters. The results are competitive with techniques proposed earlier and demonstrate that even the simple bag-of-words model for command logs is useful for distinguishing masquerading sessions from proper sessions.

  • The address information is for the authors that have a + after their name.
  • Authors who are presenting talks have a * after their name.

Back to the full JSM 2003 program

JSM 2003 For information, contact meetings@amstat.org or phone (703) 684-1221. If you have questions about the Continuing Education program, please contact the Education Department.
Revised March 2003