User Behavioral Modeling of Web-based Systems for Continuous User Authentication

Authentication plays an important role in how we interact with computers, mobile devices, the web, etc. The idea of authentication is to uniquely identify a user before granting access to system privileges. For example, in recent years more corporate information and applications have been accessible via the Internet and Intranet. Many employees are working from remote locations and need access to secure corporate files. During this time, it is possible for malicious or unauthorized users to gain access to the system. For this reason, it is logical to have some mechanism in place to detect whether the logged-in user is the same user in control of the user's session. Therefore, highly secure authentication methods must be used. We posit that each of us is unique in our use of computer systems. It is this uniqueness that is leveraged to "continuously authenticate users" while they use web software. To monitor user behavior, n-gram models are used to capture user interactions with web-based software. This statistical language model essentially captures sequences and sub-sequences of user actions, their orderings, and temporal relationships that make them unique by providing a model of how each user typically behaves. Users are then continuously monitored during software operations. Large deviations from "normal behavior" can possibly indicate malicious or unintended behavior. This approach is implemented in a system called Intruder Detector (ID) that models user actions as embodied in web logs generated in response to a user's actions. User identification through web logs is cost-effective and non-intrusive. We perform experiments on a large fielded system with web logs of approximately 4000 users. For these experiments, we use two classification techniques; binary and multi-class classification. We evaluate model-specific differences of user behavior based on coarse-grain (i.e., role) and fine-grain (i.e., individual) analysis. A specific set of metrics are used to provide valuable insight into how each model performs. Intruder Detector achieves accurate results when identifying legitimate users and user types. This tool is also able to detect outliers in role-based user behavior with optimal performance. In addition to web applications, this continuous monitoring technique can be used with other user-based systems such as mobile devices and the analysis of network traffic.

Photochemistry and transport of tropospheric ozone and its precursors in urban and remote environments

Tropospheric ozone (O3) adversely affects human health, reduces crop yields, and contributes to climate forcing. To limit these effects, the processes controlling O3 abundance as well as that of its precursor molecules must be fully characterized. Here, I examine three facets of O3 production, both in heavily polluted and remote environments. First, using in situ observations from the DISCOVER-AQ field campaign in the Baltimore/Washington region, I evaluate the emissions of the O3 precursors CO and NOx (NOx = NO + NO2) in the National Emissions Inventory (NEI). I find that CO/NOx emissions ratios derived from observations are 21% higher than those predicted by the NEI. Comparisons to output from the CMAQ model suggest that CO in the NEI is accurate within 15 ± 11%, while NOx emissions are overestimated by 51-70%, likely due to errors in mobile sources. These results imply that ambient ozone concentrations will respond more efficiently to NOx controls than current models suggest. I then investigate the source of high O3 and low H2O structures in the Tropical Western Pacific (TWP). A combination of in situ observations, satellite data, and models show that the high O3 results from photochemical production in biomass burning plumes from fires in tropical Southeast Asia and Central Africa; the low relative humidity results from large-scale descent in the tropics. Because these structures have frequently been attributed to mid-latitude pollution, biomass burning in the tropics likely contributes more to the radiative forcing of climate than previously believed. Finally, I evaluate the processes controlling formaldehyde (HCHO) in the TWP. Convective transport of near surface HCHO leads to a 33% increase in upper tropospheric HCHO mixing ratios; convection also likely increases upper tropospheric CH3OOH to ~230 pptv, enough to maintain background HCHO at ~75 pptv. The long-range transport of polluted air, with NO four times the convectively controlled background, intensifies the conversion of HO2 to OH, increasing OH by a factor of 1.4. Comparisons between the global chemistry model CAM-Chem and observations show that consistent underestimates of HCHO by CAM-Chem throughout the troposphere result from underestimates in both NO and acetaldehyde.