We define personal risk detection as the timely identification of when someone is in the midst of a dangerous situation, for example, a health crisis or a car accident, events that may jeopardize a person’s physical integrity. We work under the hypothesis that a risk-prone situation produces sudden and significant deviations in standard physiological and behavioural user patterns. These changes can be captured by a group of sensors, such as the accelerometer, gyroscope, and heart rate. We introduce a dataset, called PRIDE, which provides a baseline for the development and the fair comparison of personal risk detection mechanisms. PRIDE contains information on 18 test subjects; for each subject, it includes partial information about the user’s behavioural and physiological patterns, as captured by Microsoft Band©. PRIDE test subject records include sensor readings of not only when a subject is carrying out ordinary daily life activities, but also when exposed to a stressful scenario, thereby simulating a dangerous or abnormal situation. We show how to use PRIDE to develop a personal risk detection mechanism; to accomplish this, we have tackled risk detection as a one-class classification problem. We have trained several classifiers based only on the daily behaviour of test subjects. Further, we tested the accuracy of the classifiers to detect anomalies that were not included in the training process of the classifiers. We used a number of one-class classifiers, namely: SVM, Parzen, and two versions of Parzen based on k-means. While there is still room for improvement, our results are encouraging: they support our hypothesis that abnormal behaviour can be automatically detected.

Most studies in masquerade detection focus mainly on the user action, ignoring the object upon which that action is performed. This may yield limited models, since, for example, command execution (an action) usually ends up in the transformation of a file (the object). The overall goal of this paper is to prove that the object is paramount to distinguishing a user from a masquerade. With this in mind, we have developed a new approach to masquerade detection, called file system navigation, and tested our ideas using the Windows-Users and Windows-Intruder simulations Logs Data set, (WUIL) which unlike other datasets of its kind includes close-to-real simulated attacks. We have shown that our approach makes it possible to capture computer behavior in an abstract way difficult to realize in a purely action-based approach. In this paper, we introduce an abstraction called locality, the tendency of programs to cluster references to memory. While temporal locality is applicable to both actions and objects, spatial locality is more suitable to objects, as it depends on a notion of position. We have successfully validated our working hypothesis: locality-based features better capture user behavior for masquerade detection. Particularly, results based on our approach report an Area Under the Curve (AUC) of the receiver operating characteristic curve value of 0.97 in average with 30% of users having an AUC equal to or above 0.99.