DECISION TREE AND FORENSIC METHODOLOGY FOR DETECTING AND PREVENTING INTERNAL ATTACKERS

Computer Engineering

At present many computer systems log in pattern as user id and passwords to authenticate users. In an organization the people share their log in with colleagues and request these colleagues to complete the co tasks, there by affect the computer domain security. Internal attackers are known users of the system, who attack the system internally and its difficult to detect. In this paper, we propose Decision Tree and Forensic Methodology for Detecting and preventing internal attackers. Decision Tree and forensic Methodology creates user profile for users to keep track of their usage habits called as forensic features. Decision Tree and forensic Methodology work with intrusion detection mechanism. Network based attacks are identified by predefined algorithm. Decision Tree and forensic Methodology collected in the class limited system call list, as a key component of the system call monitor and filter. Decision Tree and forensic Methodology feasibility and accuracy are verified by Decisive rate threshold. User’s Forensic features are identified and analyzed by corresponding system call sequence. Decision Tree and forensic Methodology able to port into parallel system to enhance the accuracy of attack detection and shorten the attacker’s response time.

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.