A key log Mining Technique to analyze web usage access pattern in an Organization for Internet access Security

Abstract

One of the most comprehensive way of providing security to internet access is through firewall. Firewall is a mechanism which allows rule based internet access. Certain sites can be blocked, few sites can be allowed and few sites can be given restricted access through internet security. But internet is ever evolving. New sites come in everyday. It makes the firewall managers and Network administrator’s Job very difficult to manage and restrict sites. In large corporate IP address based logging is enabled to view the sites the employees are accessing. One of the security policies includes logging of packets from which important information can be gathered regarding the type of sites or the contents accessed by the user. This technique has certain disadvantage in a sense that the information propagated are packet based and can only trace the files that are accessed through the internet infrastructure of the organization. There are several bypasses that can be designed to overcome this system for example the user may use an alternative internet access gateway like one through GPRS which entirely bypass the LAN logger or the firewall. This may also include data extraction through wireless interface like Bluetooth or wifi. Assuming the fact that personal data access is not allowed in such a corporate environment we propose a unique technique for accessing the internet activity of the user by logging the keystrokes and further extracting meaningful information from the logs. As user presses keyboard or mouse keys, it is logged by generating an interrupt to the kernel as a background process. The logged data is encrypted using RC4 cryptosystem with an administrative password. The log files are decrypted periodically and data is analyzed using data mining technique to get an overview of the activities of the user. The process is a background process and log files cannot be manipulated like that of internet access log. Hence the method is secured, efficient and well suited for pattern extraction from user internet access.

 

Keywords: component; formatting; style; styling; insert (Minimum 5 to 8 key words)