PROVIDING SECURITY AGAINST INSIDER ATTACKS

The proposed approach employs data mining and forensic techniques to identify the representative SC-patterns for a user. The time that a habitual SC pattern appears in the user¿s log ¿le is counted, the most commonly used SC-patterns are ¿ltered out, and then a user¿s pröle is established. By identifying a user¿s SC-patterns as his/her computer usage habits from the user¿s current input SCs, the PSAIA resists suspected attackers. The experimental results demonstrate that the average detection accuracy is higher than 94% when the decisive rate threshold is 0.9, indicating that the PSAIA can assist system administrators to point out an insider or an attacker in a closed environment. The further study will be done by improving PSAIA¿s performance and investigating third-party shell commands.