Masquerade Detection Using Support Vector Machines in the Smart Grid

In the Smart grid, network security is the important part. In this paper, we will introduce a new method detection based on Support Vector Machines to detect Masquerade attack, and test it and other methods on the dataset from keyboard commands on a UNIX platform. The presence of shared tuples would cause many attacks in this dataset to be difficultly detected, just as other researchers shown. In order to eliminate their negative influence on masquerade detection, we take some preprocessing for the dataset before detecting masquerade attacks. Our results show that after removing the shared tuples, the classifiers based on support vector machines outperforms the original approaches presented.

1. Introduction

Computer attacks are an important security problem while the masquerade attack may be one of the most serious attacks [1] including the smart grid system. Literally masquerading is the attempt of substituting oneself for another. It can be a very serious menace to the computer system security. Some other intrusions may be less severe than Masquerading. Let's take DoS (Denial of Service) for example, DoS is also a kind of usual and serious attack, but its purpose is just stopping prevalent services. Different from the DoS, masquerading may obtain secure information or destroy the whole computer system after getting super privilege. From the view of user, masquerading may be one of the most serious threats. Moreover, the detection of masquerade attacks is more difficulty than that of other attacks. By mimicking the legitimate user's behavior, the masquerade attack won't be detected by most intrusion detection systems. In order to elude detection, some smart masqueraders insert some common or meaningless commands such as “Is” into their command sequences intentionally for concealing their actual purpose, resulting in the miss alarms of intrusion detection system.