title: Dynamic sample size detection in learning command line sequence for continuous authentication.
abstract: Continuous authentication (CA) consists of authenticating the user repetitively throughout a session with the goal of detecting and protecting against session hijacking attacks. While the accuracy of the detector is central to the success of CA, the detection delay or length of an individual authentication period is important as well since it is a measure of the window of vulnerability of the system. However, high accuracy and small detection delay are conflicting requirements that need to be balanced for optimum detection. In this paper, we propose the use of sequential sampling technique to achieve optimum detection by trading off adequately between detection delay and accuracy in the CA process. We illustrate our approach through CA based on user command line sequence and naïve Bayes classification scheme. Experimental evaluation using the Greenberg data set yields encouraging results consisting of a false acceptance rate (FAR) of 11.78% and a false rejection rate (FRR) of 1.33%, with an average command sequence length (i.e., detection delay) of 37 commands. When using the Schonlau (SEA) data set, we obtain FAR = 4.28% and FRR = 12%.
authors.affiliation: Electrical and Computer Engineering Department, University of Victoria, Victoria, BC V8W 3P6, Canada. itraore@ece.uvic.ca
authors.forename: Issa
authors.initials: I
authors.lastname: Traore
authors.forename: Isaac
authors.initials: I
authors.lastname: Woungang
authors.forename: Youssef
authors.initials: Y
authors.lastname: Nakkabi
authors.forename: Mohammad S
authors.initials: MS
authors.lastname: Obaidat
authors.forename: Ahmed Awad E
authors.initials: AA
authors.lastname: Ahmed
authors.forename: Bijan
authors.initials: B
authors.lastname: Khalilian
mesh_terms: D000465:Algorithms; D001185:Artificial Intelligence; D003195:Computer Communication Networks; D016494:Computer Security; D010363:Pattern Recognition, Automated / Q000379:methods*; D018401:Sample Size; D012815:Signal Processing, Computer-Assisted