learning user signatures through symbolic learning (LUS)
(Michalski, Kaufman, Pietrzykowski, Wojtusiak)
This project is concerned with the development of a new methodology for automatically building incremental models of computer user behavior and applying these models to user verification and intrusion/misuse detection. The methodology is based on the application of multiple advanced methods of machine learning.
Among the technologies being applied are constructive induction, with a focus on time-related attributes, learning using ngrams, and the application of EPIC, a new classification method that classifies not based on individual events, but rather on episodes, i.e., sequences of events viewed as a whole, even if the knowledge by which classifications are made is based on individual events. We are also exploring multistrategy methods for user profiling that integrate machine learning with Bayesian reasoning.
For references, see publications section.