Using well-known techniques for classifying user behavior profiles

Abstract

The security of a computer is based on the realization of confidentiality, integrity, and availability. A computer can keep track of computer users to improve the security in the system. However, this does not prevent a user from impersonating another user. If a computer system can model the behavior of the users, it can be very beneficial detecting masqueraders, assisting them or predicting their future actions. In this paper, we present three different methods for classifying the behavior of a computer user. The proposed three methods are: Bayesian Netwoks, Hidden Markov Models and a method based on Term Weighting (TFIDF). These three techniques have been chosen because we want to assess pure statistical techniques (Bayesian Networks) and information-oriented techniques (TFIDF) against a technique that appears to be more adequate (at least in principle) for identifying the behavior of users (HMMs).