Example
Consider, as an example, a simple cloud network where 3 usersU1 , U2 , and U2 share the same login IPs, IP1 and IP2. Also suppose that the probabilities that IP1 and IP2 could be used by a masquerader are:P(IP1 ) = 0.4, and P(IP2 )= 0.5, and the probabilities that,U1 , U2 , and U2 reveal to be masqueraders according to their behaviors in all their participating host machines in the cloud system are: P(U1)= 0.4, P(U2)= 0.3, and P(U3)= 0.6, and the detection threshold =0.75. We use the previous equation to compute the PCmasq(Ui) value for each Ui to determine which one is a real masquerader according to both the corresponding host and network audits
PCmasq(U1) = ((0.4*0.4) / (0.4+0.3+0.6) + (0.4*0.5) / (0.4+0.3+0.6)) + 0.4 = 0.6769 < 0.75 (not masquerader)
PCmasq(U2) = ((0.3*0.4) / (0.4+0.3+0.6) + (0.3*0.5) / (0.4+0.3+0.6)) + 0.3 = 0.5076 < 0.75
PCmasq(U3) = ((0.6*0.4) / (0.4+0.3+0.6) + (0.6*0.5) / (0.4+0.3+0.6)) + 0.6 = 1.0153 > 0.75 (masquerader)