Preliminary Results on Masquerader Detection using Compression Based Similarity Metrics

Abstract

This paper extends a series of experiments performed by Schonlau et al. [1] on the detection of computer masqueraders (i.e. illegitimate users trying to impersonate legitimate ones). A compression-based classication algorithm called Normalized Compression Distance or NCD, developed by Vitányi et al. [2] is applied on the same data set. It is shown that the NCD-based approach performs as well as the methods previously tried by Schonlau et al. Future work, possible enhancements and directions of further research on this topic are presented as well.