GUI Usage Analysis for Masquerade Detection

This paper investigates a new method for detecting masquerade attacks. A masquerade attack is a form of attack wherein the attacker uses someone else's identity or one system assumes the identity of another system. One extremely simple and dangerous form of a masquerade attack occurs when an attacker begins using an unattended and unlocked computer. In this paper, we present a new method for detecting this type of masquerade attack, based on the notion of how the current user interacts with the graphical user interface. This method does not use mouse movements or keystroke dynamics, rather profiles how the user manipulates the windows, icons, menus, and pointers that comprise a graphical user interface. In order to evaluate the performance of our method, we conducted some empirical studies in a real operational environment. While our results show some variations in performance, our method was able to detect up to 95% of simulated masquerade attacks with no false alarms. Furthermore, our method shows potential for use in real-time systems, requiring less data than other GUI interaction-based masquerade detection techniques while using a much simpler classification engine.