  In the UNIX/Linux environment the kernel can log every command process
created by every user with process accounting. Thus process accounting logs
have many potential uses, particularly the monitoring and forensic
investigation of security events. Previous work successfully leveraged the use
of process accounting logs to identify a difficult to detect and damaging
intrusion against high performance computing (HPC) clusters, masquerade
attacks, where intruders masquerade as legitimate users with purloined
authentication credentials. While masqueraders on HPC clusters were found to be
identifiable with a high accuracy (greater than 90%), this accuracy is still
not high enough for HPC production environments where greater than 99% accuracy
is needed.
  This paper incrementally advances the goal of more accurately identifying
masqueraders on HPC clusters by seeking to identify features within command
sets that distinguish masqueraders. To accomplish this goal, we created
NVision-PA, a software tool that produces text and graphic statistical
summaries describing input processing accounting logs. We report NVision-PA
results describing two different process accounting logs; one from Internet
usage and one from HPC cluster usage. These results identify the distinguishing
features of Internet users (as proxies for masqueraders) posing as clusters
users. This research is both a promising next step toward creating a real-time
masquerade detection sensor for production HPC clusters as well as providing
another tool for system administrators to use for statistically monitoring and
managing legitimate workloads (as indicated by command usage) in HPC
environments.
