当前位置: X-MOL 学术Int. J. Inf. Secur. › 论文详情
Our official English website, www.x-mol.net, welcomes your feedback! (Note: you will need to create a separate account there.)
Mitigating insider threat by profiling users based on mouse usage pattern: ensemble learning and frequency domain analysis
International Journal of Information Security ( IF 3.2 ) Pub Date : 2021-05-20 , DOI: 10.1007/s10207-021-00544-9
Metehan Yildirim , Emin Anarim

Exploring novel security layers in academia and industry is always a concern due to the types of malware developing currently. Adding a widely applicable security layer into existing ones in terms of verification can be achieved by profiling users by their behaviors. A great candidate may be mouse dynamics. The nature of behavioral biometry based on mouse dynamics contains less sensitive data and still can perform well enough. We present a verification model based on assigning legality scores to individual mouse actions and aggregate these scores to assign a legality probability to the whole session while investigating frequency domain features of movement sequences. How the combinational schemes can improve the performance of the overall system is also investigated. The publicly known Balabit Dataset which contains 10 users’ training and test sessions is used for evaluation. The classifiers are trained with only training sessions and evaluated on test sessions. After extensive several experiments, equal error rate with a value of 7.46% and area under the receiver operating characteristic curve with a value of 96.47% are achieved.



中文翻译:

通过基于鼠标使用模式的用户配置文件来减轻内部威胁:集成学习和频域分析

由于当前正在开发的恶意软件类型,在学术界和行业中探索新型安全层始终是一个令人担忧的问题。通过验证用户的行为,可以在验证方面将广泛适用的安全层添加到现有安全层中。一个很好的候选人可能是鼠标动力学。基于鼠标动力学的行为生物测定法的本质包含的敏感数据较少,并且仍然可以很好地执行。我们提出了一个基于为单个鼠标动作分配合法性分数的验证模型,并将这些分数汇总以为整个会话分配合法性概率,同时调查运动序列的频域特征。还研究了组合方案如何改善整个系统的性能。评估使用包含10个用户的培训和测试课程的公开已知的Balabit数据集。仅通过培训课程对分类器进行培训,并在测试课程中对其进行评估。经过广泛的实验,获得了相等的错误率(值为7.46%)和在接收器工作特性曲线下的面积(值为96.47%)。

更新日期:2021-05-20
down
wechat
bug