Hidden Markov Model for Masquerade Detection Based on Sequence Alignment

A masquerade attack, in which an attacker impersonates a legitimate user to utilize the user's privileges, can be triggered either by someone within the organization or by an outsider. We propose the sequence alignment based hidden Markov model (SA-HMM) approach, where we incorporate the benefits of both the sequence alignment and continuous hidden Markov model (HMM). The sequence alignment module for the proposed algorithm allows the algorithm to tolerate variations in user activity sequence. The HMM module takes the positional information between the observations of users into account. The proposed approach achieves a high hit ratio of 94.1% outperforming existing masquerade detection approaches.