Detecting masquerades in intrusion detection based on unpopular commands

Computer intruders are modern day burglars: some of them steal information, some wreak havoc to the system, some just want to prove they can break in. Computer intrusion detection is concerned with designing alarm systems to prevent break-ins. This paper presents a method for detecting intruders/users masqueradering a s other users. We examine UNIX command streams of users and search for anom alies. We identify anomalies based on unpopular and uniquely used commands. (C) 2000 Elsevier Science B.V. All rights reserved.