Enhancing the accuracy of network-based intrusion detection with host-based context

Lecture Notes in Computer Science

Volumn 3548, Issue Detection of Intrusions and Malware, and Vulnerability Assessment: Second International Conference, DIMVA 2005. Proceedings, 2005, Pages 206-221

  Dreger, Holger ^a   Kreibich, Christian ^b   Paxson, Vern ^c   Sommer, Robin ^a  

^a TECHNICAL UNIVERSITY OF MUNICH   (Germany)

^b UNIVERSITY OF CAMBRIDGE   (United Kingdom)

^c LAWRENCE BERKELEY NATIONAL LABORATORY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTATIONAL COMPLEXITY; COMPUTER NETWORKS; HTTP; PROBLEM SOLVING; TELECOMMUNICATION TRAFFIC;

INTRUSION DETECTION; NETWORK-BASED SYSTEMS; TRAFFIC ANALYSIS;

SECURITY OF DATA;

EID: 26444591908     PISSN: 03029743     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1007/11506881_13     Document Type: Conference Paper

References (26)

1. Ptacek, T.H., Newsham, T.N.: Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection. Technical report, Secure Networks, Inc. (1998)
2. Handley, M., Kreibich, C., Paxson, V.: Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics. In: Proc. 10th USENIX Security Symposium. (2001)
3. Shankar, U., Paxson, V.: Active Mapping: Resisting NIDS Evasion Without Altering Traffic. In: Proc. IEEE Symposium on Security and Privacy. (2003)
4. Porras, P.A., Neumann, P.G.: EMERALD: Event monitoring enabling responses to anomalous live disturbances. In: National Information Systems Security Conference, Baltimore, MD (1997)
5. Vigna, G., Kemmerer, R.A.: Netstat: A network-based intrusion detection system. Journal of Computer Security 7 (1999) 37-71
6. Spafford, E.H., Zamboni, D.: Intrusion Detection Using Autonomous Agents. Computer Networks 34 (2000) 547-570
7. Paxson, V.: Bro: A System for Detecting Network Intruders in Real-Time. Computer Networks 31 (1999)
8. Almgren, M., Lindqvist, U.: Application-Integrated Data Collection for Security Monitoring. In: Proc. of Recent Advances in Intrusion Detection (RAID). Lecture Notes in Computer Science, Springer-Verlag (2001)
9. Welz, M., Hutchison, A.: Interfacing Trusted Applications with Intrusion Detection Systems. In: Proc. of Recent Advances in Intrusion Detection (RAID). Lecture Notes in Computer Science, Springer-Verlag (2001)
10. Sommer, R., Paxson, V.: Exploiting Independent State For Network Intrusion Detection. Technical Report TUM-I0420, TU München (2004)
11. Kreibich, G., Sommer, R.: Policy-controlled Event Management for Distributed Intrusion Detection. In: Proc. 4th International Workshop on Distributed Event-Based Systems. (2005)
12. Sommer, R., Paxson, V.: Enhancing Byte-Level Network Intrusion Detection Signatures with Context. In: Proc. 10th ACM Conference on Computer and Communications Security. (2003)
13. Broccoli: The Bro Client Communications Library. http://www.cl. cam.ac.uk/~cpk25/broccoli/
14. Roesch, M.: Snort: Lightweight Intrusion Detection for Networks. In: Proc. 13th Systems Administration Conference (LISA). (1999) 229-238
15. Hoglund, G., McGraw, G.: Exploiting Software: How to Break Code. Addison Wesley Professional (2004)
16. Berners-Lee, T., Fielding, R., Irvine, U., Masinter, L. Uniform Resource Identifiers (URI): Generic Syntax (1998) RFC 2396.
17. Roelker, D.J. HTTP IDS Evasions Revisited. http://www.sourcefire.com/ products/downloads/secured/sf_HTTP_IDS_evasio ns.pdf (2004)
18. Internet Security Systems Security Alert Multiple Vendor IDS Unicode Bypass Vulnerability. http://xforce.iss.net/xforce/alerts/id/advise95 (2001)
19. CVE-2001-0333. http://www.cve.mitre.org/cgi-bin/cvename.cgi? name=CVE-2000-0884 (2001)
20. Dreger, H., Feldmann, A., Paxson, V., Sommer, R.: Operational Experiences with High-Volume Network Intrusion Detection. In: Proc. 11th ACM Conference on Computer and Communications Security. (2004)
21. libwhisker. http://www.wiretrip.net/rfp
22. Puppy, R.F. A Look At Whisker's Anti-IDS Tactics. http://www. wiretrip.net/rfp/pages/whitepapers/whiskerids.html (1999)
23. Nikto. http://www.cirt.net/code/nikto.shtml
24. Roelker, D.J. URL encoder. http://code.idsresearch.org/encoder.c
25. Mosberger, D., Jin, T.: httperf - A Tool For Measuring Web Server Performance. In: Proc. of the First Workshop on Internet Server Performance (WISP '98), Madison, WI. (1998) 59-67
26. mod_benchmark Apache plugin. http://www.trickytools.com/php/ mod_benchmark.php