Abstract #302215

This is the preliminary program for the 2003 Joint Statistical Meetings in San Francisco, California. Currently included in this program is the "technical" program, schedule of invited, topic contributed, regular contributed and poster sessions; Continuing Education courses (August 2-5, 2003); and Committee and Business Meetings. This on-line program will be updated frequently to reflect the most current revisions.

To View the Program:
You may choose to view all activities of the program or just parts of it at any one time. All activities are arranged by date and time.

The views expressed here are those of the individual authors
and not necessarily those of the ASA or its board, officers, or staff.

Back to main JSM 2003 Program page
JSM 2003 Abstract #302215
Activity Number: 359
Type: Topic Contributed
Date/Time: Wednesday, August 6, 2003 : 10:30 AM to 12:20 PM
Sponsor: Section on Statistical Computing
Abstract - #302215
Title: Learning User Behavior for Detecting Insider Misuses
Author(s): Yihua Liao*+
Companies: University of California, Davis
Address: 5000 Orchard Park Cir. #5612, Davis, CA, 95616,
Keywords: insider threat ; user profiling ; anomaly detection ; Evolving Fuzzy Neural Network ; adaptive learning
Abstract:

Insiders pose a serious threat to the security of computer systems and computational infrastructures. There are two general types of malicious insiders: masqueraders who operate under another legitimate user's ID, and misfeasors who are authorized to use the information system but abuse their privileges. Anomaly detection is a typical approach to detecting an insider's misuses, based on the assumption that insider misuses are unusual activities that departs from a normal user profile. However, the success of anomaly detection has been limited due to its unsatisfying performance, mainly the high rate of false alarms caused by "concept drift." We present our user behavior level anomaly detection framework, based on the theory of the Evolving Fuzzy Neural Network. Multiple and heterogeneous data are integrated to build user behavior profiles, and adaptive learning techniques are employed to reduce the false alarm rate. We detail our preliminary experiments with the Windows NT user profiling data and discuss the directions for future research.

  • The address information is for the authors that have a + after their name.
  • Authors who are presenting talks have a * after their name.

Back to the full JSM 2003 program

JSM 2003 For information, contact meetings@amstat.org or phone (703) 684-1221. If you have questions about the Continuing Education program, please contact the Education Department.
Revised March 2003