PROVIDING SECURITY AGAINST INSIDER ATTACKS

The proposed approach employs data mining and forensic techniques to identify the representative SC-patterns for a user. The time that a habitual SC pattern appears in the user’s log file is counted the most commonly used SC-patterns are filtered out and then a user’s profile is established. By identifying a user’s SC-patterns as his/her computer usage habits from the user’s current input SCs the PSAIA resists suspected attackers. The experimental results demonstrate that the average detection accuracy is higher than 94% when the decisive rate threshold is 0.9 indicating that the PSAIA can assist system administrators to point out an insider or an attacker in a closed environment. The further study will be done by improving PSAIA’s performance and investigating third-party shell commands.