Get 20M+ Full-Text Papers For Less Than $1.50/day. Start a 14-Day Trial for You or Your Team.

Learn More →

Unsupervised anomaly detection within non‐numerical sequence data by average index difference, with application to masquerade detection

Unsupervised anomaly detection within non‐numerical sequence data by average index difference,... Anomaly detection within non‐numerical sequence data has developed into an important topic of data mining, but comparatively little research has been done regarding anomaly detection without training data (unsupervised anomaly detection). One application found in computer security is the detection of a so‐called masquerade attack, which consists of an attacker abusing a regular account. This leaves only the session input, which is basically a string of non‐numerical commands, for analysis. Our previous approach to this problem introduced the use of the so‐called average index difference function for mapping the non‐numerical symbol data to a numerical space. In the present paper, we examine the theoretical properties of the average index difference function, present an enhanced unsupervised anomaly detection algorithm based on the average index difference function, show the parameters to be theoretically inferable, and evaluate the performance using real‐world data. Copyright © 2014 John Wiley & Sons, Ltd. http://www.deepdyve.com/assets/images/DeepDyve-Logo-lg.png Applied Stochastic Models in Business and Industry Wiley

Unsupervised anomaly detection within non‐numerical sequence data by average index difference, with application to masquerade detection

Loading next page...
 
/lp/wiley/unsupervised-anomaly-detection-within-non-numerical-sequence-data-by-2L27Ra501e

References (19)

Publisher
Wiley
Copyright
Copyright © 2014 John Wiley & Sons, Ltd.
ISSN
1524-1904
eISSN
1526-4025
DOI
10.1002/asmb.2057
Publisher site
See Article on Publisher Site

Abstract

Anomaly detection within non‐numerical sequence data has developed into an important topic of data mining, but comparatively little research has been done regarding anomaly detection without training data (unsupervised anomaly detection). One application found in computer security is the detection of a so‐called masquerade attack, which consists of an attacker abusing a regular account. This leaves only the session input, which is basically a string of non‐numerical commands, for analysis. Our previous approach to this problem introduced the use of the so‐called average index difference function for mapping the non‐numerical symbol data to a numerical space. In the present paper, we examine the theoretical properties of the average index difference function, present an enhanced unsupervised anomaly detection algorithm based on the average index difference function, show the parameters to be theoretically inferable, and evaluate the performance using real‐world data. Copyright © 2014 John Wiley & Sons, Ltd.

Journal

Applied Stochastic Models in Business and IndustryWiley

Published: Jan 1, 2014

Keywords: ; ; ; ; ;

There are no references for this article.