Masquerade detection using support vector machine

A new method using support vector data description (SVDD) to distinguish legitimate users from masqueraders based on UNIX user command sequences is proposed. Sliding windows are used to get low detection delay. Experiments demonstrate that the detection effect using enriched sequences is better than that of using truncated sequences. As a SVDD profile is composed of a small amount of support vectors, our SVDD-based method can achieve computation and storage advantage when the detection performance is similar to existing method.