The value of intrusion detection systems in information technology security architecture

Information Systems Research

Volumn 16, Issue 1, 2005, Pages 28-46

  Cavusoglu, Huseyin ^a   Mishra, Birendra ^b   Raghunathan, Srinivasan ^c  

^a TULANE UNIVERSITY   (United States)

^b UNIVERSITY OF TEXAS AT DALLAS   (United States)

^c UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

Economics of IT security; Intrusion detection systems (IDSs); IT security management; ROC curves; Security configuration

Indexed keywords

COMPUTER CRIME; COMPUTER SYSTEM FIREWALLS; ECONOMICS; INDUSTRIAL MANAGEMENT; INFORMATION TECHNOLOGY; LAWS AND LEGISLATION; SECURITY OF DATA; SOCIETIES AND INSTITUTIONS;

ECONOMICS OF IT SECURITY; INTRUSION DETECTION SYSTEM (IDS); IT SECURITY MANAGEMENT; ROC CURVES; SECURITY CONFIGURATION;

COMPUTER ARCHITECTURE;

EID: 18944385964     PISSN: 10477047     EISSN: None     Source Type: Journal    
DOI: 10.1287/isre.1050.0041     Document Type: Article

References (85)

1. Aguirre, S. J., W. H. Hill. 1997. Intrusion detection fly-off: Implications for the United States Navy. MITRE Technical Report MTR 97W096, McLean, VA.
2. Allen, J., A. Christie, W. Fithen, J. McHugh, J. Pickel, E. Stoner. 2000. State of the practice of intrusion detection technologies. Technical Report CMU/SEI-99-TR-028 ESC-99-028, Pittsburgh, PA.
3. Alpert, B. 1999. As e-tailing booms on the net, so does the demand for virtual security. Barren's 79(4) 25.
4. Amoroso, E. 1999. Intrusion Detection. Intrusion.Net Books, NJ.
5. Axelsson, S. 2000. The base-rate fallacy and the difficulty of intrusion detection. ACM Trans. Inform. System Security 3(3) 186-205.
6. Bace, R., P. Mell. 2001. NIST special publication on intrusion detection systems. SP-800-31. National Institute of Standards and Technology.
7. Baiman, S. 1982. Agency research in managerial accounting: A survey. J. Accounting Literature 1154-213.
8. Bashir, I, E. Serafini, K. Wall. 2001. Securing network software applications: Introduction. Comm. ACM. 44(2) 28-30.
9. Becker, G. 1968. Crime and punishment: An economic approach. J. Political Econom. 76 169-217.
10. CERT (Computer Emergency and Response Team). 2000. Detecting Signs of Intrusion. CERT Security Improvement Modules, Pittsburgh, PA.
11. Debar, H., M. Dacier, A. Wespi, S. Lampart. 1998. A Workbench for Intrusion Detection Systems. IBM Zurich Laboratory, Ruschlikon, Switzerland.
12. Denning, D. E. 1987. An intrusion detection model. IEEE Trans. Software Engrg. 13(2) 222-232.
13. Denning, D. E. 2000. Reflections on cyberweapons controls. Comput. Security J. 16(4) 43-53.
14. D'haeseleer, P., S. Forrest, P. Helman. 1996. An immunological approach to change detection: Algorithms, analysis, and implications. Proc. IEEE Sympos. Security Privacy, 110-119.
15. Durst, R., T. Champion, B. Witten, E. Miller, L. Spagnuolo. 1999. Testing and evaluating computer intrusion detection systems. Comm. ACM 42(7) 53-61.
16. Dye, R. A. 1986. Optimal monitoring policies in agencies. RAND J. Econom. 17 339-350.
17. Escamilla, T. 1998. Intrusion Detection: Network Security Beyond the Firewall. John Wiley & Sons, New York.
18. Feichtinger, G. 1983. A differential games solution to a model of competition between a thief and the police. Management Sci. 29 686-699.
19. Fellingham, J. C., P. Newman. 1985. Strategic considerations in auditing. Accounting Rev. 60(4) 634-650.
20. Fisch, E. A., G. B. White. 2000. Secure Computer and Networks. CRC Press, Boca Raton, FL.
21. Frincke, D., J. Evans, D. Aucutt. 1996. Hierarchical management of misuse reports. Proc. Internat. Conf. Comput. Inform., Ontario, Canada.
22. Fudenberg, D., D. Levine. 1998. The Theory of Learning in Games. MIT Press, Cambridge, MA.
23. Fudenberg, D., J. Tirole. 1993. Game Theory. MIT Press, Cambridge, MA.
24. Gartner. 2003. Hype cycle for information security. Gartner Research Report (May 30), Stamford, CT.
25. Garvey, T., T. Lunt. 1991. Model-based intrusion detection. Proc. 14th National Comput. Security Conf., Washington, D.C.
26. Goodman, M. D., S. W. Brenner. 2002. The emerging consensus on criminal conduct in Cyberspace. UCLA J. Law Tech. (3).
27. Hansanyi, J. C. 1967. Games with incomplete information played by Bayesian players, I: Basic model. Management Sci. 14(3) 159-182.
28. Hansanyi, J. C. 1968a. Games with incomplete information played by Bayesian players, II: Bayesian equilibrium points. Management Sci. 14(5) 320-334.
29. Hansanyi, J. C. 1968b. Games with incomplete information played by Bayesian players, III: The basic probability distribution of the game. Management Sci. 14(7) 486-502.
30. Hulme, H. 2002. Businesses keep spending on security. Inform. Week (January 28).
31. Ilgun, K. 1992. Ustat: A real-time intrusion detection system for Unix. Master's thesis, Computer Science Department, University of California at Santa Barbara, CA.
32. Internet Security Systems. 2001. The truth about false positives. Technical White Paper, Internet Security Systems, Atlanta, GA.
33. Jajodia, S., J. Miller. 1993. Editor's preface. J. Comput. Security 16(4) 43-53.
34. Kanodia, C. S. 1985. Stochastic and moral hazard. J. Accounting Res. 23 175-193.
35. Kilgour, D. M. 1992. Site selection for on-site inspection in arms control. Arms Control 13(13) 439-462.
36. Koerner, B. I. 1999. Who are hackers, anyway? U.S. News World Rep. 17(2) 53.
37. Kumar, S., E. Spafford. 1996. A pattern matching model for misuse intrusion detection. The COAST Project, Purdue University, West Lafayette, IN.
38. Lee, W., W. Fan, M. Miller, S. Stolfo, E. Zadok. 2002. Toward cost-sensitive modeling for intrusion detection and response. J. Comput. Security 10(1/2) 5-22.
39. Lippmann, R. P., D. J. Fried, I. Graf, J. W. Haines, K. R. Kendall, D. McClung, D. Weber, S. E. Webster, D. Wyschogrod, R. K. Cunningham, M. A. Zissman. 2000a. Evaluating intrusion detection systems: The 1998 DARPA off-line intrusion detection evaluation. Proc. 2000 DARPA Inform. Survivability Conf. Exposition (DISCEX) 2 12-26.
40. Lippmann, R. P., J. W. Haines, D. J. Fried, J. Kobra, K. Das. 2000b. The 1999 DARPA off-line intrusion detection evaluation. Comput. Networks 34(2) 579-595.
41. Lunt, T. 1990. Ides: An intelligent system for detecting intruders. Proc. Sympos.: Comput. Security, Threat Countermeasures, Rome, Italy.
42. Lunt, T. 1993. A survey of intrusion detection systems. Comput. Security 12 405-418.
43. Lunt, T., R. Jagannathan. 1988. A prototype real-time intrusion detection system. Proc. 1988 IEEE Sympos. Security Privacy, Oakland, CA.
44. Lunt, T., A. Tamaru, F. Gilham, R. Jagannathan, R. C. Jalali, H. Javitz, A. Valdos, P. Neumann, T. Garvey. 1992. A real-time intrusion detection expert system. Technical report, Consumer Science Laboratory, SRI International, Menlo Park, CA.
45. Maschler, M. 1966. A price leadership method for solving the inspector's non-constant-sum game. Naval Res. Logist. Quart. 13 11-33.
46. Maschler, M. 1967. The inspector's non-constant-sum game: Its dependence on a system of detectors. Naval Res. Logist. Quart. 14 275-290.
47. McCarthy, L. 1998. Intranet Security. Sun Microsystems Press, Santa Clara, CA.
48. McHugh, J. 2000. Testing intrusion detection systems: A critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory. ACM Trans. Inform. System Security 3(4) 262-294.
49. McHugh, J., A. C. Christie, J. Allen. 2000. Defending yourself: The role of intrusion detection systems. IEEE Software 17(5) 42-51.
50. Mell, P., V. Hu, R. Lippmann, J. Haines, M. Zissman. 2002. An Overview of Issues in Testing Intrusion Detection Systems. NIST IR 7007, Gaithersburg, MD.
51. Messmer, E. 1999. Getting the drop on network intruders. Network World (October 4).
52. Mishra, B. K., P. Newman, C. Stinson. 1997. Environmental regulations and incentives for compliance audits J. Accounting Public Policy 16(2) 187-214.
53. Monrose, F., A. Rubin. 1997. Authentication via keystroke dynamics. 4th ACM Conf. Comput. Comm. Security, Zurich, Switzerland.
54. Mookherjee, D., I. P. L. Png. 1992. Monitoring vis-à-vis investigation in enforcement of law. Amer. Econom. Rev. 82(3) 556-565.
55. Mueller, P., G. Shipley. 2001. Dragon claws its way to the top. Network Comput. 20(August) 45-67.
56. National Computer Security Center. 1988. A Guide to Understanding Audit in Trusted Systems. NCSC-TG-001, Version 2 June), The Rainbow Series, Meade, MD.
57. Neumann, P., P. Porras. 1999. Experience with emerald to date. Proc. 1st USENIX Workshop Intrusion Detection Network Monitoring, Santa Clara, CA, 73-80.
58. Newman, P., S. Rhoades, R. Smith. 1996. Allocating audit resources to detect fraud. Rev. Accounting Stud. 1161-182.
59. NIST Publication 800-12. 1996. An Introduction to Computer Security. National Institute of Standards and Technology, Gaithersburg, MD.
60. Northcutt, S. 1999. Evaluating intrusion detection systems without attacking your friends. Network Intrusion Detection 86.
61. NSS Group. 2001. Intrusion Detection Systems Group Test, Ed. 2. Oakwood House, Wennington, Cambridgeshire, UK (December).
62. Panko, R. 2003. Corporate Computer and Network Security. Prentice Hall, NJ.
63. Peltier, T. R. 2001. Information Security Risk Analysis. Auerbach Publications, Boca Raton, FL.
64. Polinsky, A., S. Shavell. 1979. The optimal trade-off between the probability and magnitude of fines. Amer. Econom. Rev. 69 880-891.
65. Porras, P., R. Kemmerer. 1992. Penetration state transition analysis: A rule-based intrusion detection approach. IEEE 8th Annual Comput. Security Appl. Conf., San Antonio, TX, 220-229.
66. Porras, P., P. Neumann. 1997. Emerald: Event monitoring enabling responses to anomalous live disturbances. Proc. 20th Nat. Inform. Systems Security Conf., Baltimore, MD, 353-365.
67. Power, R. 2002. CSI/FBI computer crime and security survey. Comput. Security Isssues Trends 8(1) 1-22.
68. Proctor, P. E. 2001. The Practical Intrusion Detection Handbook. Prentice Hall, NJ.
69. Ptacek, T. H., T. N. Newsham. 1998. Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection. Secure Networks Inc., Calgary, Alberta, Canada.
70. Puketza, N., M. Chung, R. O. Olsson, B. Mukherjee. 1997. A software platform for testing intrusion detection systems. IEEE Software 14(5) 43-51.
71. Rothke, B. 2000. Hackers then and now: Answers to some perennial questions. Comput. Security J. 16(3) 11-14.
72. Russell, D., G. T. Gangemi. 1992. Computer Security Basics. O'Reilly & Associates, Inc., Sebastopol, CA.
73. Russell, G. S. 1990. Game models for structuring monitoring and enforcement systems. Natural Resource Modeling 4 143-173.
74. Sethi, S. P. 1979. Optimal pilfering policies for dynamic continuous thieves. Management Sci. 25(6) 535-542.
75. Shavell, S. 1991. Specific versus general enforcement of the law. J. Political Econom. 99 1088-1108
76. Shaw, D. S., J. M. Post, K. G. Ruby. 1999. Inside the minds of the insider. Security Management (December) 34-44.
77. Shipley, G. 1999. ISS RealSecure pushes past newer IDS players. Network Comput. (May 17).
78. Sriram, T. 2002. Blocking virus requests in Novell bordermanager's HTTP accelerator. Feature article, Novell Appnotes, Waltham, MA.
79. Stigler, G. 1970. The optimum enforcement of laws. J. Political Econom. 78 526-536.
80. Thomas, M. U., Y. Nisgav. 1976. An infiltration game with time dependent payoff. Naval Res. Logist. Quart. 23 297-302.
81. Trees, H. V. 2001. Detection, Estimation and Modulation Theory - Part I. John Wiley, New York.
82. Tudor, J. K. 2001. Information Security Architecture. Auerbach Publications, Boca Raton, FL.
83. Weissenberger, S. 1992. Deterrence and the design of treaty verification systems. IEEE Trans. Systems, Man, Cybernetics 22 903-915.
84. Yocom, B., K. Brown. 2001. Intrusion Battleground Evolves. Network World (October 8) 53-62.
85. Zamboni, D., E. Spafford. 1999. New directions for the AAPHID architecture. Workshop Recent Adv. Intrusion Detection, West Lafayette, IN.