Abstract

A usage based pattern authenticator for monitoring and reporting on user usage patterns in an operating system using a set of security rules and user usage patterns. This computer system security tool authenticates users at the operating system level in multi-user operating systems. It supports system administrators in limiting the ability of unauthorized users to disrupt system operations using a neural network and set of rules to track usage patterns and flag suspicious activity on the system. The data collection mode collects and stores usage patterns of authenticated users. The training mode trains an artificial neural network and sets the interconnection weights of the network. The production mode monitors and reports on usage patterns, and optionally performs automatic responses when confronted with non-authenticated users.

Other References

• Brown et al.; "Practical Approach to User Authentication". 10th Annual Proceedings of the Computer Security Applications Conference, Dec. 1994, pp. 108-116.
• Lin, D.; "Computer-Access Authentication with Neural Network Based Keystroke Identity Verification". International Conference on Neural Networks, Jul. 1997, vol. 1, pp. 174-178.
• Obaidat, M.S.; "A Verification Methodology for Computer Systems Users". Proceedings of the 1995 ACM Symposium on Applied Computing, Feb. 1995, pp. 258-262.
• Monrose et al.; "Authentication via Keystroke Dynamics". Proceedings of the 4th ACM Conference on Computer and Communications Security, Apr. 1997, pp. 48-56.
• Held et al.; "Match-A New High-Level Relational Operator for Pattern Matching". Communications of the ACM, Jan. 1987, vol. 30, Iss. 1, pp. 62-75.
• Shepherd, S.J.; "Continuous Authentication by Analysis of Keyboard Typing Characters". European Convention on Security and Detection, May 1995, pp. 111-11