Masquerade Attack Identification Via DDSGA-Based Anomaly Detection

To take advantage of the user services and privileges, a masquerade attacker poses as a legitimate user. The semi- global alignment algorithm (SGA) is one of the most effective and efficient techniques to detect these attacks but it has not yet reached the accuracy and performance required by large scale, multiuser systems. To improve both the effectiveness and the performances of this algorithm, the Data-Driven Semi – Global Alignment, DDSGA approach was proposed. By implementing unique alignment settings for every user, DDSGA enhances the scoring systems from the perspective of security effectiveness. Additionally, by permitting minor adjustments to the low-level representation of the instructions’ functionality, it can withstand minor variations in user command sequences. It also adapts to changes in the user behavior by updating the signature of a user according to its current behavior. To optimize the runtime overhead, DDSGA minimizes the alignment overhead and parallelism the detection and the update.