User Behavioral Modeling of Web-based Systems for Continuous User Authentication

Authentication plays an important role in how we interact with computers, mobile devices, the web, etc. The idea of authentication is to uniquely identify a user before granting access to system privileges. For example, in recent years more corporate information and applications have been accessible via the Internet and Intranet. Many employees are working from remote locations and need access to secure corporate files. During this time, it is possible for malicious or unauthorized users to gain access to the system. For this reason, it is logical to have some mechanism in place to detect whether the logged-in user is the same user in control of the user's session. Therefore, highly secure authentication methods must be used. We posit that each of us is unique in our use of computer systems. It is this uniqueness that is leveraged to "continuously authenticate users" while they use web software. To monitor user behavior, n-gram models are used to capture user interactions with web-based software. This statistical language model essentially captures sequences and sub-sequences of user actions, their orderings, and temporal relationships that make them unique by providing a model of how each user typically behaves. Users are then continuously monitored during software operations. Large deviations from "normal behavior" can possibly indicate malicious or unintended behavior. This approach is implemented in a system called Intruder Detector (ID) that models user actions as embodied in web logs generated in response to a user's actions. User identification through web logs is cost-effective and non-intrusive. We perform experiments on a large fielded system with web logs of approximately 4000 users. For these experiments, we use two classification techniques; binary and multi-class classification. We evaluate model-specific differences of user behavior based on coarse-grain (i.e., role) and fine-grain (i.e., individual) analysis. A specific set of metrics are used to provide valuable insight into how each model performs. Intruder Detector achieves accurate results when identifying legitimate users and user types. This tool is also able to detect outliers in role-based user behavior with optimal performance. In addition to web applications, this continuous monitoring technique can be used with other user-based systems such as mobile devices and the analysis of network traffic.

Multiple sulfur isotope fractionations in inorganic aqueous systems

New constraints on isotope fractionation factors in inorganic aqueous sulfur systems based on theoretical and experimental techniques relevant to studies of the sulfur cycle in modern environments and the geologic rock record are presented in this dissertation. These include theoretical estimations of equilibrium isotope fractionation factors utilizing quantum mechanical software and a water cluster model approach for aqueous sulfur compounds that span the entire range of oxidation state for sulfur. These theoretical calculations generally reproduce the available experimental determinations from the literature and provide new constraints where no others are available. These theoretical calculations illustrate in detail the relationship between sulfur bonding environment and the mass dependence associated with equilibrium isotope exchange reactions involving all four isotopes of sulfur. I additionally highlight the effect of isomers of protonated compounds (compounds with the same chemical formula but different structure, where protons are bound to either sulfur or oxygen atoms) on isotope partitioning in the sulfite (S4+) and sulfoxylate (S2+) systems, both of which are key intermediates in oxidation-reduction processes in the sulfur cycle. I demonstrate that isomers containing the highest degree of coordination around sulfur (where protonation occurs on the sulfur atom) have a strong influence on isotopic fractionation factors, and argue that isomerization phenomenon should be considered in models of the sulfur cycle. Additionally, experimental results of the reaction rates and isotope fractionations associated with the chemical oxidation of aqueous sulfide are presented. Sulfide oxidation is a major process in the global sulfur cycle due largely to the sulfide-producing activity of anaerobic microorganisms in organic-rich marine sediments. These experiments reveal relationships between isotope fractionations and reaction rate as a function of both temperature and trace metal (ferrous iron) catalysis that I interpret in the context of the complex mechanism of sulfide oxidation. I also demonstrate that sulfide oxidation is a process associated with a mass dependence that can be described as not conforming to the mass dependence typically associated with equilibrium isotope exchange. This observation has implications for the inclusion of oxidative processes in environmental- and global-scale models of the sulfur cycle based on the mass balance of all four isotopes of sulfur. The contents of this dissertation provide key reference information on isotopic fractionation factors in aqueous sulfur systems that will have far-reaching applicability to studies of the sulfur cycle in a wide variety of natural settings.