Covariance matrix method based technique for masquerade detection

In masquerade attack, the attacker access legitimate user's computer and impersonates that legitimate user. It can be the most serious form of computer abuse. Since masquerade detection is an anomaly based intrusion detection, a legitimate user profile is created and detection is done based on this user profile. In this paper, User profile is created from covariance matrices. A noticeable deviation from legitimate user profile is classified as masquerade attack. The work is done on the Schonlau dataset [1]. The experiment with attack features and legitimate features is conducted and it provides 100% accuracy rate for both attack data and legitimate data.