A Novel Software System Protection Scheme Based on Behavior and Context Monitoring

A Novel Software System Protection Scheme Based on Behavior and Context Monitoring

Shen Fu (Iowa State University, USA), Mathew L. Wymore (Iowa State University, USA), Ting-Wei Chang (Iowa State University, USA) and Daji Qiao (Iowa State University, USA)
Copyright: © 2019 |Pages: 25
DOI: 10.4018/IJSSSP.2019010102

Abstract

The restriction of access to software systems is more important than ever. Yet, most primary authentication methods are still largely based on passwords, which are vulnerable to various attacks such as phishing scams and keyloggers. Advanced methods of behavior-based authentication exist, but most are platform-specific and are not generally applicable. In this article, the authors propose a generic continuous authentication scheme for software systems, which supplements existing authentication schemes and works as an auxiliary layer to provide additional protection against impostors. The kernel of their scheme is a novel monitoring engine that detects impostors in real-time based on behavior and context information. The authors evaluate their scheme on a dataset consisting of real users' historical records provided by their industrial partner, and the results demonstrate that the approach achieves a high classification accuracy with only a short delay in detection, allowing for real-time, continuous authentication.
Article Preview
Top

Introduction

Motivation

News stories about security and data breaches of software systems have become commonplace. Yet companies and individuals continue to store an increasing amount of critical information on particularly vulnerable systems, such as web services. Therefore, restricting access to software systems is more important than ever. However, many of these systems are accessible from anywhere in the world and are protected with only a password.

But passwords are becoming more vulnerable as the Internet grows and attacking schemes such as phishing scams and keyloggers become more prevalent. Even the most secure password-based system can be easily hacked if a malicious individual obtains the login information of a legitimate user, or physically accesses an unattended device with an active user session. Therefore, the authors are motivated to seek innovative user authentication schemes for software systems that can provide security beyond passwords, especially for those vulnerable cloud systems. Furthermore, these schemes should be as generic as possible in order to be applicable to a wide range of systems.

Complete Article List

Search this Journal:
Reset
Open Access Articles: Forthcoming
Volume 11: 2 Issues (2020): Forthcoming, Available for Pre-Order
Volume 10: 2 Issues (2019): 1 Released, 1 Forthcoming
Volume 9: 4 Issues (2018)
View Complete Journal Contents Listing