Using instance-weighted naive Bayes for adapting concept drift in masquerade detection.
Saved in:
| Title: | Using instance-weighted naive Bayes for adapting concept drift in masquerade detection. |
|---|---|
| Authors: | Sen, Sevil1 ssen@cs.hacettepe.edu.tr |
| Source: | International Journal of Information Security. Nov2014, Vol. 13 Issue 6, p583-590. 8p. |
| Subjects: | Masqueraders (Computer users), Malware, Text mining, Bayes' theorem, Detectors |
| Abstract: | Although there are many approaches proposed for masquerade detection in the literature, few of them consider concept drift; the problem of distinguishing malicious behaviours from the natural change in user behaviours. Researchers mainly focus on updating user behaviours for adapting concept drift in masquerade detection. However, these approaches rely on the accuracy of the detector and do not take into account malicious instances which are erroneously added to the updating scheme. In this study, we show that conventional approaches based on instance selection are affected dramatically when misclassified intrusive data are added to the training data. Therefore, we propose a new approach based on instance weighting which updates user behaviours gradually according to the weights assigned to each instance, regardless of them being malicious or non-malicious. The results show that the proposed approach outperforms the other updating schemes in the literature, where the malicious instances are more than 5 % of the benign instances in the updating, which is very likely to happen due to the high miss rate of the existing detectors. [ABSTRACT FROM AUTHOR] |
| Copyright of International Journal of Information Security is the property of Springer Nature and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) | |
| Database: | Engineering Source |
Be the first to leave a comment!
