AUTOMATIC INTERNAL FORENSIC MECHANISM FOR INTRUSION DETECTION

Computer Engineering

ABSTRACT Now days, to authenticate users as the login patterns, most computer systems use user IDs and passwords. However, many people share their login patterns with co-workers and request these co-workers to assist co-tasks, thereby making the paradigm as one of the weakest points of computer safety. Insider attackers, the valid users of a system who attack the system internally, are difficult to invent since most intrusion detection systems and firewalls identify and isolate malicious behaviours exposed from the external world of the system only. In addition, some studies claimed that analysing system calls (SCs) generated by commands can recognize these commands, with which to accurately detect attacks, and attack patterns are the features of an invasion. so, in this paper, a security system, named the Internal Intrusion Detection , Protection System (IIDPS), are developed to invention insider attacks at SC level by using data mining and forensic techniques. The IIDPS synchronize users’ personal profiles to keep path of users’ usage habits as their forensic features and determines whether a authenticated login user is the account holder or not by comparing his/her current computer usage behaviours with the patterns gathered in the account holder’s personal profile. The experiment all results analysed that the IIDPS’s user identification precision is 94.29%, whereas the response time is less than 0.45 s, implying that it can servive a protected system from insider invasion impressive and efficiently.

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.