A Highly Accurate Internal Intrusion Detection and ProtectionSystem Using Time Linked Access Profiles
DOI:
https://doi.org/10.46243/jst.2021.v6.i1.pp141-147Keywords:
Intrusion Detection Systems, System security, Time Linked Access Profiles, Central Processing Unit, Message Passing Interface, Virtual Machines, Distributed Denial of ServiceAbstract
Because most intrusion detection systems and firewalls identify and separate malicious traits that only come from the external environment of the system. It is difficult to differentiate between the actual system users, the internal attackers who access the device.Also, studies claim that these commands can be recognized by analyzing the system calls produced by these commands.This system, therefore, includes an Intrusion Detection and Protection System (IDPS) security system to detect internal attacks on the System Call (SC) using data mining and forensic techniques.However, some attacks have improved their method, further providing security and preventing the user from tracking user access profiles and patterns. In this work, a new technique is proposed to prevents profile attacks by disconnecting access patterns from users for a specified period based onTime Linked Access Profiles (TLAP). To evaluate the performance detection accuracy is calculated and it is improved when compared to the convolution neural network
References
Leu,Fang-Yie, Kun-Lin Tsai, Yi-Ting Hsiao, and Chao-Tung Yang. "An internal intrusion detection and protection system by using data mining and forensic techniques." IEEE Systems Journal 11, no. 2 (2015): 427-438
Song,Jinwoo, and Young Moon. "Security Enhancement Against Insiders in Cyber-Manufacturing Systems." Procedia Manufacturing 48 (2020): 864-872
Bu, Seok-Jun, and Sung-Bae Cho. "A convolutional neural-based learning classifier system for detecting database intrusion via insider attack." Information Sciences 512 (2020): 123-136
Colwill, Carl. "Human factors in information security: The insider threat–Who can you trust these days?." Information security technical report 14, no. 4 (2009): 186-196
Elmrabit, Nebrase, Shuang-Hua Yang, Lili Yang, and Huiyu Zhou. "Insider Threat Risk Prediction based on Bayesian Network." Computers & Security (2020): 101908
Li, Hongtu, Liang Hu, Wei Yuan, Hongwei Li, and Jianfeng Chu. "Insider attack on a password-based group key agreement." Procedia Engineering 15 (2011): 1700-1704
Mubarak, Sameera, and Jill Slay. "Protecting clients from insider attacks on trust accounts." Information security technical report 14, no. 4 (2009): 202-212
Platos, Jan, Vaclav Snasel, Pavel Kromer, and Ajith Abraham. "Detecting insider attacks using non-negative matrix factorization." In 2009 Fifth International Conference on Information Assurance and Security, vol. 1, pp. 693-696. IEEE, 2009
Sarkar, Kuheli Roy. "Assessing insider threats to information security using technical, behavioural and organisational measures." information security technical report 15, no. 3 (2010): 112-133
Shi, Wenbo, Injoo Jang, and HyeongSeonYoo. "An inside attacker proof intrusion detection system." In 2009 Fourth International Conference on Computer Sciences and Convergence Information Technology, pp. 1020-1024. IEEE, 2009
Inayat, Zakira, Abdullah Gani, Nor BadrulAnuar, Shahid Anwar, and Muhammad Khurram Khan. "Cloud-based intrusion detection and response system: open research issues, and solutions." Arabian Journal for Science and Engineering 42, no. 2 (2017): 399-423
Yin, Chunyong, Luyu Ma, and Lu Feng. "Towards accurate intrusion detection based on improved clonal selection algorithm." Multimedia Tools and Applications 76, no. 19 (2017): 19397-19410
Shterenberg, S. I., and Maria A. Poltavtseva. "A distributed intrusion detection system with protection from an internal intruder." Automatic Control and Computer Sciences 52, no. 8 (2018): 945-953
OSSEC. [Online]. Available: http://www.ossec.net/
AIDE. [Online]. Available: http://aide.sourceforge.net/
