Proximity User Identification Using Correlogram

  • Shervin Shahidi
  • Parisa Mazrooei
  • Navid Nasr Esfahani
  • Mohammad Saraee
Part of the IFIP Advances in Information and Communication Technology book series (IFIPAICT, volume 340)


This paper represents a technique, applying user action patterns in order to distinguish between users and identify them. In this method, users’ actions sequences are mapped to numerical sequences and each user’s profile is generated using autocorrelation values. Next, cross-correlation is used to compare user profiles with a test data. To evaluate our proposed method, a dataset known as Greenberg’s dataset is used. The presented approach is succeeded to detect the correct user with as high as 82.3% accuracy over a set of 52 users. In comparison to the existing methods based on Hidden Markov Model or Neural Networks, our method needs less computation time and space. In addition, it has the ability of getting updated iteratively which is a main factor to facilitate transferability.


User Identification Correlation Classification Pattern Recognition 


  1. Skin, E., Lee, W., Stolfo, S.: Modeling system calls for intrusion detection with dynamic window sizes. In: DARPA Information Survivability Conference and Exposition II (DISCEX II), Anaheim, vol. 1, pp. 165–175 (2001)Google Scholar
  2. Ye, N.: A markov chain model of temporal behavior for anomaly detection. In: The 2000 IEEE Systems, Man, and Cybernetics Information Assurance and Security Workshop, pp. 171–174 (2000)Google Scholar
  3. Lane, T., Brodley, C.: Sequence matching and learning in Anomaly Detection for computer security. In: The Fourth National Conference on Artificial Intelligence, pp. 43–49 (1997)Google Scholar
  4. Warrender, C., Forrest, S., Pearlmutter, B.: Detecting intrusions using system calls: alternative data models. In: 1999 IEEE Symposium on Security and Privacy, pp. 133–145 (1999)Google Scholar
  5. Javitz, H., Valdes, A.: The NIDES statistical component: description and justification. Computer Science Laboratory, SRI International, Tech. Report (1993)Google Scholar
  6. Knorr, E., Ng, R.: Algorithms for mining distance-based outliers in large data sets. In: 24th Int. Conf. Very Large Data Bases, VLDB, Technique et Science Informatiques, pp. 392–403 (1998)Google Scholar
  7. Knorr, E., Ng, R.: Finding international knowledge of distance-based outliers. The VLDB Journal, 211–222 (1999)Google Scholar
  8. Breunig, V., Kriegel, H., Ng, R., Sander, J.: LOF: identifying density-based local outliers. In: ACM SIGMOD Int. Conf. on Management of Data, pp. 93–104 (2000)Google Scholar
  9. Portnoy, L., Eskin, E., Stolfo, S.: Intrusion detection with unlabeled data using clustering. In: ACM CSS Workshop on Data Mining Applied to Security (DMSA 2001), Philadelphia, PA (2001)Google Scholar
  10. Galassi, U., Giordana, A., Saitta, L., Botta, M.: Learning Profiles Based on Hirarcical Hidden Markov Model. In: Hacid, M.-S., Murray, N.V., Raś, Z.W., Tsumoto, S. (eds.) ISMIS 2005. LNCS (LNAI), vol. 3488, pp. 47–55. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  11. Link, H., Lane, T., Magliano, J.: Models and Model Biases for Automatically Learning Task Switching Behavior. In: Proceedings of the 2005 HCI International (HCII) Conference on Augmented Cognition, HCI International, HCII (2005)Google Scholar
  12. Lee, W., Stolfo, S.: Data mining approaches for intrusion detection. In: 1998 USENIX Security Symposium (1998)Google Scholar
  13. Greenberg, S.: Using Unix: collected traces of 168 users. In: Research Report 88/333/45, Includes Tar-Format Cartridge Tape. Department of Computer Science, University of Calgary, Alberta (1998)Google Scholar

Copyright information

© IFIP International Federation for Information Processing 2010

Authors and Affiliations

  • Shervin Shahidi
    • 1
  • Parisa Mazrooei
    • 1
  • Navid Nasr Esfahani
    • 2
  • Mohammad Saraee
    • 3
  1. 1.Intelligent Databases, Data Mining and Bioinformatics Research Laboratory, Department of Electrical and Computer EngineeringIsfahan University of TechnologyIsfahanIran
  2. 2.Isfahan Mathematics HouseIsfahanIran
  3. 3.School of Computing, Science and EngineeringUniversity of SalfordGreater ManchesterUK

Personalised recommendations