Methods, systems, and media for masquerade attack detection by monitoring computer user behavior

A system for detecting masquerade attacks, the system comprising:

• at least one hardware processor that is configured to:
• monitor a first plurality of user actions in a computing environment;
• generate a user intent model based on the first plurality of user actions;
• monitor a second plurality of user actions in the computing environment;
• determine whether at least one of the second plurality of user actions deviates from the generated user intent model;
• determine whether the second plurality of user actions include performing an action on a file in the computing environment that contains decoy information in response to determining that at least one of the second plurality of user actions deviates from the generated user intent model;
• and
• generate an alert in response to determining that the second plurality of user actions include performing an action on a file in the computing environment that contains decoy information.

A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting masquerade attacks, the method comprising:

• monitoring a first plurality of user actions in a computing environment;
• generating a user intent model based on the first plurality of user actions;
• monitoring a second plurality of user actions in the computing environment;
• determining whether at least one of the second plurality of user actions deviates from the generated user intent model;
• determining whether the second plurality of user actions include performing an action on a file in the computing environment that contains decoy information in response to determining that at least one of the second plurality of user actions deviates from the generated user intent model;
• and
• generating an alert in response to determining that the second plurality of user actions include performing an action on a file in the computing environment that contains decoy information.