Detection for User Impersonation Attacks in Mobile Social Networks Based on High-order Markov Chains

• DOI: 10.1007/s11036-025-02449-6
• Publication Date: 2025-04-03T00:28:40Z
• Authors: Wenhui Gong; Yi Huang; Youcef Djenouri; Syed Atif Moqurrab

Abstract In security defense of MSN (MSN), attackers often impersonate themselves as other users, making it difficult to detect network user attacks based on user behavior. Multi-order Markov chains can consider the front-to-back correlation of user behavior, thereby more accurately identifying disguised users. Therefore, this paper proposes a user impersonation attack detection method based on multi-order Markov chains. First, the relevance coefficient method is used to determine the order of the multi-order Markov chain, and by defining appropriate multi-order Markov chain states to capture key features in user behavior, a multi-order Markov chain is established. Then, through the multi-order Markov chain combined with Shell commands, the normal behavior profile of legitimate users is established, and based on this, the probability of occurrence of the state sequence is calculated to complete the detection of userimpersonation attacks. The experimental results show that the similarity between the results of the proposed method and the actual situation in detecting impersonation attacks is more than 97%, indicating that this method can detect MSN user impersonation attacks with high accuracy.