USim: A User Behavior Simulation Framework for Training and Testing IDSes in GUI Based Systems

Anomaly detection systems largely depend on user profile data to be able to detect deviation from normal activity. Most of this profile data is based on commands executed by users on a system and may not represent user’s complete behavior which is essential for effectively detecting the anomalies in the system. Collection of user behavior data is a slow and time consuming process. In this paper, we propose a new approach to automate the generation of user data by parameterizing user behavior in terms of user intention (malicious/normal), user skill level, set of applications installed on a machine, mouse movement and keyboard activity. The user behavior parameters are used to generate templates, which can be further customized. The framework is called USim which achieves rapid generation of user behavior data based on these templates on GUI based systems. The data thus generated can be utilized for rapidly training and testing intrusion detection systems (IDSes) and improving thei...

• Type: Conference
• Year: 2006
• Where: ANSS
• Authors: Ashish Garg, Vidyaraman Sankaranarayanan, Shambhu J. Upadhyaya, Kevin A. Kwiat
• Keywords: ANSS 2006, User Behavior, User Behavior Data, User’s Complete Behavior