|| Volume 3 || Issue 6 || June 2018 || ISSN (Online) 2456-0774

INTERNATIONAL JOURNAL OF ADVANCE SCIENTIFIC RESEARCH

AND ENGINEERING TRENDS

Real Time Tracking of Malicious Activities

Occurring Internally on the System
Mr. Mashhood Sayed, Ms. Supriti Sinha, Ms. Ria Matapurkar, Mr. Danish Shaikh Prof. Kanchan Wankhade
B.E Students, at Computer Engineering Dept. Dhole Patil College of Engineering, Wagholi, Maharashtra, India1234
Asst. Professor, at Computer Engineering Dept. Dhole Patil College of Engineering, Wagholi, Maharashtra, India5

ABSTRACT: Now a day’s lot of the users use ids and because firewalls and intrusion detection systems (IDSs)
password as login pattern for the authenticate users. normally fight against outside attack. Now a days, To
However making patterns is weakest point of computer Authentic users, most systems check user ID and password as
security as so many user share the login pattern with the a login pattern. However, attackers may be install Trojan to
co-workers for the completed co-task, inside attacker is hack the password and When successful, they may then log in
attacked internally and it will be valid attacker of system, to the system, access users’ private files, or modify or destroy
As using intrusion detection systems and firewalls identify system settings. Fortunately, most current host-based security
and isolate harmful behaviors generated from the outside systems [3] and network-based IDSs [4], [5] can discover a
world we can find out internal attacker of the system only. known intrusion in a real-time manner. Attack packets are
In some of the studied define examine that system calls often issued with forged IPs or attackers may enter a system
generated by some commands and these command help to with valid login patterns that’s why it’s very difficult to
find detect accurate attacks, and attack patterns are the identify who is attacker. However in Operating System level
features of an attack. However in the paper security system calls (SCs) is more helpful to find out attacker and
System define as the Internal Intrusion Detection and identify the exact attack [6], processing a large volume of SCs,
Protection System (IIDPS), is help to detect internally detecting harmful behaviors from them, and detecting possible
attacks by using data mining and forensic technique at SC attackers for an intrusion are still engineering challenges
level. For the track the information of users usages the Therefore, in this paper, we propose a security system, at SC
IIDPS creates users’ personal profiles as their forensic level which detects harmful behaviors launched toward a
features and investigate that the valid login user is account system named Internal Intrusion Detection and Protection
holder can login or not by comparing his/her current System (IIDPS). To mine system call patterns (SC-patterns)
computer usage behaviors with the patterns collected in defined as the longest system call sequence (SC-sequence)
the account holder’s personal profile. The experimental that has repeatedly appeared several times in a user’s log file
results demonstrate that the IIDPS’s user identification for the user the IIDPS uses data mining and forensic profiling
accuracy is 94.29%, whereas the response time is less than techniques. The user’s forensic features, define is as an SC
0.45 s, implying that it can prevent a protected system Pattern find out in submitted by users SC sequences but
from insider attacks effectively and efficiently. normally used by other users computer usage history.
KEYWORDS: Data mining, insider attack, intrusion detection The contributions of this paper are: 1) identify a
and protection, system call (SC), users’ behaviors. user’s forensic features by analyzing the corresponding SCs to
enhance the accuracy of attack detection; 2) able to port the
I INTRODUCTION
IIDPS to a parallel system to further shorten its detection
In the past 10 years, computer systems have been response time; and 3) effectively resist insider attack.
largely employed to provide users with easier and more
perfect lives. However, System securities is the one of the II LITERATURE SURVEY
serious issue in computer domain when users take advantages All In Computer forensics science, we can views
of powerful capabilities since attackers very usually try to computer systems as crime scenes, aims to identify, preserve,
forcely enter in the computer systems and behave spitefully or recover, analyze, and present facts and opinions on
harmfully, e.g. corrupt critical data of a company, making the information collected for a security event [7]. exactly what
systems out of work or destroying the systems. pharming attacker done such things will be recognized such as spreading
attack, distributed denial-of-service (DDoS), eavesdropping computer viruses, malwares, and malicious codes and
attack, and spear-phishing attack generally all this attack are conducting DDoS attacks [8].Intrusion detection techniques
well known attacks [1], [2], insider attack is most difficult for most of the focus on how to find harmful network behaviors
the detected [9], [10] and based on the histories recorded in log files we

WWW.IJASRET.COM 8
 || Volume 3 || Issue 6 || June 2018 || ISSN (Online) 2456-0774
INTERNATIONAL JOURNAL OF ADVANCE SCIENTIFIC RESEARCH
AND ENGINEERING TRENDS
acquire the characteristics of attack packets, i.e. attack bridge for operating both side of information flow between the
patterns[11], [12]. In [10] Author used self-developed packets user’s domain and the utility domain.
for compare to collect network packets with which to III PROPOSED SYSTEM
discriminate network attacks with the help of network states
In this approach, log file is stored into two different
and packet distribution. In [4] from system log files we
forms as well as in two different places. Log file in plain text
acquired network intrusion and attack patterns. These files
from is stored on target host and a copy of same log file is
contain tracked information of misuse computer. It means that,
stored in another host called log manager. When intruder tried
from synthetically generated log files, these traces or patterns
to acquire log file IDS running on the based host to detect
of misuse can be more accurately reproduced. In [3]Author
exact intrusion and then it will be give an alert to security
overviewed research progress of applying methods of
administrator about the intrusion which is take require
computational intelligence, including artificial neural
decision to mitigate them.
networks, fuzzy systems, evolutionary computation, artificial
A. System Framework:
immune systems, and swarm intelligence, to detect malicious
Target Host
behaviors.
In the Target Host, Crucial data (i.e. log files) is
The author can compared different intrusion systems
stored. To preserve the integrity and confidentiality need to be
and systematically summarized the details hence allow us to
Continuous monitor of log file is prime requirement of the
described existing research challenges. To network security
data stored in it. To achieve this, IDS is deployed on target
these aforementioned techniques and applications truly work
host and it is a continuous process round the clock. Whenever
finely. When unauthorized user log in in to the system with
an attacker tries to intrude the target host, IDS running on
valid ID and password that time they not able to easily
target host detects the intrusion; sends an alert message to
authentic remote login user and detect specific type of
security center as well as log server. After that it will be
intrusion. In previous work [1], for collects forensic features
capture the state of the system (RAM image and log file
we can use security system for users at command level rather
image) by using Digital Forensic Tool. Then the captured log
than at SC level, by invoking data mining and forensic
file has been compared to previous log file image to confirm
techniques, was developed. Moreover, if attackers use many
the intrusion. Target host is nothing but our OS as it was host
sessions to issue attacks, e.g., multistage attacks, or launch
based system. The intrusion can try to use information of the
DDoS attacks, then it is not easy for that system to identify
system but if he try to make changes in the system properties
attack patterns. In [4] Author presented an intelligent
and access the access the records then IDs comes in to the
lightweight IDS with the help with this forensic technique
picture.
identify users behavior and a data mining technique to carry
Server:
out cooperative attacks. The authors claimed that the system
Server maintained the copy of the log file in an
could detect intrusions effectively and efficiently in real time.
encrypted form. Log file maintained the Encryption keys and
However, they did not mention the SC filter. In [9] Author
it kept secret. Periodically back up of the Target host log file
provided another example of integrating computer forensics
is taken and it is stored on the log server.it will be receiving
with a knowledge-based system. For allowing SC Sequence to
log file as backup and encrypted the file and store within it.
be executed, the system adopt predefine model. Same will be
Whenever the log server receives an alert message from target
employed by a detection system to restrict program execution
host, it decrypts the log file, computes the image of the
to ensure the security of the protected system. And same will
decrypted log file using digital forensic tool and sends it to the
be needful the identified issue a series of harmful SC’s and on
target host to perform the comparison. The main job of the
the knowledge based identified attack sequence which have
Log server is encryption and decryption of log files such that
been collected. When an undetected attack is presented, the
the intruder doesn’t have access to them. If the intruder gets to
system frequently finds the attack sequence in 2 s as its
know the location and condition of the log file shall only be
computation overhead. In [7] Author explored the
available with the owner and nobody else. It shall be provided
effectiveness of a detection approach based on machine
at the time of delivering the software as a complete product.
learning to combine the expressive power of generative
Security Centre (Admin):
models with good classification accuracy capabilities to infer
This is the system used by the security administrator
part of its knowledge from incomplete training data so that the
to monitor the alerts generated by IDS. It receives alerts from
network anomaly detection scheme can provide an adequate
Target Host. Once the target host has sent the alert to the
degree of protection from both external and internal menaces.
Security centre, the job of the Security centre starts. The attack
In [4] to enhance the security of advanced metering
is hence detected and looked into at the Security centre. The
infrastructure through an IDS Author analyzed the possibility
Security centre is the most essential component of the IDS. Its
of using data stream mining. The advanced metering
job is track the intrusion he tries to hack the system, an alert
infrastructure, is crucial part of smart card which work as
should be sent to the real owner. This will be accomplished by

WWW.IJASRET.COM 9
 || Volume 3 || Issue 6 || June 2018 || ISSN (Online) 2456-0774
INTERNATIONAL JOURNAL OF ADVANCE SCIENTIFIC RESEARCH
AND ENGINEERING TRENDS
webcam image and same will be prove the again court of law.
If the intruder tries to access the files without the net
connection, the system shall shut down by itself within 10
seconds, and if he has the net connection intact, then we shall
also be able to inform the true owner about the intrusion with
the help of an e-mail. In proposed system we are detecting the
intrusion through many thing like integrity, checking currently
running processes, by key log, etc. These all activities are
performed by user. The first activity is file integrity. We are
detecting intrusion through file integrity. In file integrity
concept if any user delete the file or modify file or insert file
into specific directory then by Using our system we can detect
it. If any file delete or modify of insert into specific folder
then that file will save in folder which is specified by client.
Then file integrity log send to server. Server send the integrity
of that file to the clients email id. So that client will easily
know which file is modified. So that that we can recover that Figure. 2. Flow of System
modified file from specified backup folder. C. Algorithms:
Input: U’s log file where U is user of the host machine.
• Output: U’s habit file or Attack Detection.
• Procedure:
G = |LogFile|-|SlidingWindow|
|SlidingWindow| = |L-Window| = |C-Window|
for(i = 0; i< G-1; i++)
{
for( j = 0; j < G-1; j++)
{
add K grams of L window in L window
add K’ grams in current C window
compare K-grams and K’ grams with subsequent algorithm.

if(the identified pattern is already exist in habit file)

increase count of SC- pattern by 1
else
{
Check the pattern in attacker profile
if(Present in profile)
insert SC-pattern into habit file with counter = 1
else
consider as attack.
}
Figure 1: System architecture }
B. Flow of System: }
IV MATHEMATICAL MODEL
This system can be used to detect the host intrusion
User: Set (U) = {u0, u1, u2, u3}
detection where host machine comprises the confidential files.
U0-insert files U1-delete files
Attackers can attack on host machine that attacks would be
U2-update files
detect by the system and updated files can be recovered by
U3-install new process
system. This system can detect the files modification and also
• Client: Set (C) = {c0, c1, c2, c3, c4, c5, c6}
prevent the file modification. If files deleted from the host
C0-capture user image
machine permanently then system cant recovered the files.
C1- generate file log
C2-generate process log

WWW.IJASRET.COM 10
 || Volume 3 || Issue 6 || June 2018 || ISSN (Online) 2456-0774
INTERNATIONAL JOURNAL OF ADVANCE SCIENTIFIC RESEARCH
AND ENGINEERING TRENDS
C3-encrypt all logs using AES algorithm algorithm. This will detect the malicious activities done by user.
C4- send encrypted files log to server
C5- send encrypted processes log to server
C6-send user image to client emailed
• Server: Set (S) = {c4, c5, s0, s1, s2, s3}
S0-decrypt all encrypted logs
S1-send files log to client email id
S2-send process log to client email id
S3-maintain history of client’s pc
• UnionandIntersectionofproject:-
Set (C) = {c0, c1, c2, c3, c4, c5, c6 }
Set (S) = {c4, c5, s0, s1, s2, s3}
C union S={c0, c1, c2, c3, c4, c5, c6, s0, s1, s2, s3}
C intersection S = {c4, c5}

Figure. 5: Habit File Generated

Figure 3. Set Intersection

V EXPERIMENTAL RESULT
This is the user GUI where user will access the
commands of computer and try to attack on the computer.
From here user or attacker can access the files of computer. If
misbehave detected then alert will send to the administrator of
the system.

Figure 6 Intrusion Alert on Admin Mail

VI CONCLUSION
In this paper for the identify SC pattern for the user
we have use data mining and forensic technique. Most
commonly used SC-patterns are filtered out when the time that
a habitual SC pattern appears in the user’s log file is counted,
and then a user’s profile is established. By identifying a user’s
SC-patterns as his/her computer usage habits from the user’s
current input SCs, the IIDPS resists suspected attackers. The
experimental results demonstrate that the average detection
accuracy is higher than 94% when the decisive rate threshold
Figure. 4: Admin Control
is 0.9, indicating that the IIDPS can assist system
In the second screen shot it shows the command accessed
administrators to point out an insider or an attacker in a closed
by the user of system. Here user can access the commands or
environment. The further study will be done by improving
system calls for which he has permission. Here attack is detected.
IIDPS’s performance and investigating third-party shell
To detect the attack here we have used common habit generation
commands.

WWW.IJASRET.COM 11
 || Volume 3 || Issue 6 || June 2018 || ISSN (Online) 2456-0774
INTERNATIONAL JOURNAL OF ADVANCE SCIENTIFIC RESEARCH
AND ENGINEERING TRENDS
REFERENCES synthetic log files containing computer attack signatures,‖
1. A. Sadeghi, C. Stuble, and M. Winandy, ―Compartmented Int. J. Ambient Comput. Intell., vol. 3, no. 2, pp. 64–76,Apr.
security for browsers—Or how to thwart a phisher with 2011.
trusted computing,‖ in Proc. IEEE Int. Conf. Avail., Rel. 15. X. Bao and R. Roy Choudhury. Movi: mobile phone
Security, Vienna, Austria, Apr. 2007, pp. 120–127. based video highlights viacollaborative sensing. In
2. C. Yue and H. Wang, ―BogusBiter: A transparent protection Proceedings of ACM MobiSys, pages 357370, 2010.
against phishing attacks,‖ ACM Trans. Int. Technol., vol. 16. J. Biagioni, T. Gerlich, T. Merrifield, and J.
10, no. 2, pp. 1–31, May 2010. Eriksson. Easytracker: automatic transit tracking, mapping,
3. Q. Chen, S. Abdelwahed, and A. Erradi, ―A model-based and arrival time prediction using smartphones. In
approach to self-protection in computing system,‖ in Proc. Proceedings of ACM SenSys, pages 114, 2011.
ACM Cloud Autonomic Comput. Conf., Miami, FL, USA, BIOGRAPHY
2013, pp. 1–10. Pooja Patangeis UG Student at Information technology
4. F. Y. Leu, M. C. Li, J. C. Lin, and C. T. Yang, ―Detection department, Dhole Patil College of Engineering, Wagholi,
workload in a dynamic grid-based intrusion detection Maharashtra, India.
environment,‖ J. Parallel Distrib. Comput. vol. 68, no. 4, pp. Kiran Mundheis UG Student at Information technology
427–442, Apr. 2008. department ,Dhole Patil College of Engineering, Wagholi,
5. H. Lu, B. Zhao, X. Wang, and J. Su, ―DiffSig: Resource Maharashtra, India.
differentiation based malware behavioral concise signature Prof. Umesh Talware Assistant Professor at, at Information
generation,‖ Inf. Commun. Technol., vol. 7804, pp. 271– technology department, Dhole Patil College of
284, 2013. Engineering,Wagholi, Maharashtra, India.
6. Z. Shan, X. Wang, T. Chiueh, and X. Meng, ―Safe side
effects commitment for OS-level virtualization,‖ in Proc.
ACM Int. Conf. Autonomic Comput., Karlsruhe, Germany,
2011, pp. 111–120.
7. M. K. Rogers and K. Seigfried, ―The future of computer
forensics: A needs analysis survey,‖ Comput. Security, vol.
23, no. 1, pp.12–16, Feb. 2004.
8. J. Choi, C. Choi, B. Ko, D. Choi, and P. Kim, ―Detecting
web based DDoS attack using MapReduce operations in
cloud computing environment,‖ J. Internet Serv. Inf.
Security, vol. 3, no. 3/4, pp. 28–37, Nov. 2013.
9. Q. Wang, L. Vu, K. Nahrstedt, and H. Khurana, ―MIS:
Malicious nodes identification scheme in network-coding-
based peer-to-peer streaming,‖ in Proc. IEEE INFOCOM,
San Diego, CA, USA, 2010, pp. 1–5.
10. Z. A. Baig, ―Pattern recognition for detecting
distributed node exhaustion attacks in wireless sensor
networks,‖ Comput. Commun., vol. 34, no. 3,pp. 468–484,
Mar. 2011.
11. H. S. Kang and S. R. Kim, ―A new logging-based IP
traceback approach using data mining techniques,‖ J.
Internet Serv. Inf. Security, vol. 3, no. 3/4, pp. 72–80, Nov.
2013.
12. K. A. Garcia, R. Monroy, L. A. Trejo, and C. Mex-
Perera, ―Analyzing log files for postmortem intrusion
detection,‖ IEEE Trans. Syst., Man, Cybern., Part C: Appl.
Rev., vol. 42, no. 6, pp. 1690–1704, Nov. 2012.
13. M. A. Qadeer, M. Zahid, A. Iqbal, and M. R.
Siddiqui, ―Network traffic analysis and intrusion detection
using packet sniffer,‖ in Proc. Int. Conf. Commun. Softw.
Netw., Singapore, 2010, pp. 313–317.
14. S. O’Shaughnessy and G. Gray, ―Development and
evaluation of a data set generator tool for generating

WWW.IJASRET.COM 12