Test Statistics for a Masquerader Detection System

A Comparison between Hidden Markov Model and Other Probabilistic Models

Abstract

The performance analysis is carried out for a masquerader detection system by a hidden Markov model (HMM). A Markov model and a probability distribution have been applied to many intrusion detection systems, however it is not clear to what extent the HMM improves the performance in detecting a masquerader, compared with other two probabilistic models. Statistics of these three models are compared and the advantage of the HMM for a masquerader detection system is clarified. Some implications useful in extending the other two probabilistic models to an HMM are also provided.