Title
Obfuscation of malicious behaviors for thwarting masquerade detection systems based on locality features
Date Issued
01 April 2020
Access level
open access
Resource Type
journal article
Publisher(s)
Multidisciplinary Digital Publishing Institute (MDPI)
Abstract
In recent years, dynamic user verification has become one of the basic pillars for insider threat detection. From these threats, the research presented in this paper focuses on masquerader attacks, a category of insiders characterized by being intentionally conducted by persons outside the organization that somehow were able to impersonate legitimate users. Consequently, it is assumed that masqueraders are unaware of the protected environment within the targeted organization, so it is expected that they move in a more erratic manner than legitimate users along the compromised systems. This feature makes them susceptible to being discovered by dynamic user verification methods based on user profiling and anomaly-based intrusion detection. However, these approaches are susceptible to evasion through the imitation of the normal legitimate usage of the protected system (mimicry), which is being widely exploited by intruders. In order to contribute to their understanding, as well as anticipating their evolution, the conducted research focuses on the study of mimicry from the standpoint of an uncharted terrain: the masquerade detection based on analyzing locality traits. With this purpose, the problem is widely stated, and a pair of novel obfuscation methods are introduced: locality-based mimicry by action pruning and locality-based mimicry by noise generation. Their modus operandi, effectiveness, and impact are evaluated by a collection of well-known classifiers typically implemented for masquerade detection. The simplicity and effectiveness demonstrated suggest that they entail attack vectors that should be taken into consideration for the proper hardening of real organizations.
Volume
20
Issue
7
Number
2084
Language
English
OCDE Knowledge area
Ingeniería de sistemas y comunicaciones Sistemas de automatización, Sistemas de control
Scopus EID
2-s2.0-85083849678
Source
Sensors (Switzerland)
ISSN of the container
14248220
Sponsor(s)
Funding: This work is funded by the European Commission Horizon 2020 Programme under grant agreement number 830892, as part of the project H2020-SU-ICT-03-2018/830892 SPARTA: Special projects for advanced research and technology in Europe.
Sources of information: Directorio de Producción Científica Scopus Scopus