Exploiting independent state for network intrusion detection

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn 2005, Issue , 2005, Pages 59-71

  Sommer, Robin ^a   Paxson, Vern ^b  

^a TECHNICAL UNIVERSITY OF MUNICH   (Germany)

^b ICSI/LBNL

Author keywords

[No Author keywords available]

Indexed keywords

DISTRIBUTED PROCESSING; NETWORK INTRUSION DETECTION SYSTEMS (NIDSS); VOLATILE PROCESSOR MEMORY;

COMPUTER NETWORKS; DATA PROCESSING; DISTRIBUTED DATABASE SYSTEMS; PROGRAM PROCESSORS; STORAGE ALLOCATION (COMPUTER);

SECURITY OF DATA;

EID: 33846281935     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CSAC.2005.24     Document Type: Conference Paper

References (28)

1. E. G. Amoroso. Intrusion Detection: An Introduction to Internet Surveillance, Correlation, Trace Back and Response. Intrusion.Net Books, New Jersey, 1999.
2. S. Axelsson. The Base-Rate Fallacy and Its Implications for the Difficulty of Intrusion Detection. In ACM Conference on Computer and Communications Security, pages 1-7, 1999.
3. CERT Advisory CA-2003-20 W32/Blaster worm. http://www.cert.org/ advisories/CA-2003-20.html.
4. Broccoli: The Bro Client Communications Library, http://www.cl.cam.ac.uk/ ~cpk25/broccoli/.
5. ENDACE Measurement Systems. http://www. endace.com/.
6. H. Debar and A. Wespi. Aggregation and Correlation of Intrusion-Detection Alerts. In Proc. Recent Advances in Intrusion Detection, number 2212 in Lecture Notes in Computer Science. Springer-Verlag, 2001.
7. H. Dreger, A. Feldmann, V. Paxson, and R. Sommer. Operational Experiences with High-Volume Network Intrusion Detection. In Proc. 11th ACM Conference on Computer and Communications Security, 2004.
8. H. Dreger, C. Kreibich, V. Paxson, and R. Sommer. Enhancing the Accuracy of Network-based Intrusion Detection with Host-based Context. In Proc. Conference on Detection of Intrusions and Malware and Vulnerability Assessment, 2005.
9. Intrusion Detection Message Exchange Format. http://www.ietf.org/html. charters/1dwg-charter.html.
10. K. Julisch. Clustering Intrusion Detection Alarms to Support Root Cause Analysis. ACM Transactions on Information and System Security, 6(4):443-471, 2003.
11. J. Jung, V. Paxson, A. W. Berger, and H. Balakrishnan. Fast Portscan Detection Using Sequential Hypothesis Testing. In Proc. IEEE Symposium on Security and Privacy, 2004.
12. C. Kreibich and R. Sommer. Policy-controlled Event Management for Distributed Intrusion Detection. In Proc. 4th International Workshop on Distributed Event-Based Systems, 2005.
13. C. Krügel, T. Toth, and C. Kerer. Decentralized Event Correlation for Intrusion Detection. In Proc. Information Security and Cryptology, volume 2288 of Lecture Notes in Computer Science, 2001.
14. C. Krügel, F. Valeur, G. Vigna, and R. A. Kemmerer. Stateful Intrusion Detection for High-Speed Networks. In Proc. IEEE Symposium on Security and Privacy, 2002.
15. OpenSSL. http://www.openssl.org.
16. V. Paxson. Bro: A System for Detecting Network Intruders in Real-Time. Computer Networks, 31(23-24):2435-2463, 1999.
17. P. A. Porras and P. G. Neumann. EMERALD: Event monitoring enabling responses to anomalous live disturbances. In National Information Systems Security Conference, Baltimore, MD, October 1997.
18. Snapp, S., et al. DIDS (Distributed Intrusion Detection System) - Motivation, Architecture, and an Early Prototype. In Proc. 14th NIST-NCSC National Computer Security Conference, 1991.
19. R. Sommer. Viable Network Intrusion Detection in High-Performance Environments. PhD thesis, TU München, 2005.
20. R. Sommer and V. Paxson. Enhancing Byte-Level Network Intrusion Detection Signatures with Context. In Proc. 10th ACM Conference on Computer and Communications Security, 2003.
21. J. Soukup. Taming C++-Pattern Classes and Persistence for Large Projects. Addison-Wesley, 1994.
22. E. H. Spafford and D. Zamboni. Intrusion Detection Using Autonomous Agents. Computer Networks, 34(4):547-570, 2000.
23. Staniford-Chen, S., et al. GrIDS - A Graph-based Intrusion Detection System for Large Networks. In Proc. 19th NIST-NCSC National Information Systems Security Conference, 1996.
24. A. S. Tanenbaum and M. V. Steen. Distributed Systems -Principles and Paradigms. Prentice Hall, 2002.
25. A. Valdes and K. Skinner. Probabilistic Alert Correlation. In Proc. Recent Advances in Intrusion Detection, number 2212 in Lecture Notes in Computer Science. Springer-Verlag, 2001.
26. G. Vigna and R. A. Kemmerer. NetSTAT: A Network-based Intrusion Detection System. Journal of Computer Security, 7(1):37-71, 1999.
27. G. Vigna, R. A. Kemmerer, and P. Blix. Designing a Web of Highly-Configurable Intrusion Detection Sensors. In Proc. Recent Advances in Intrusion Detection, number 2212 in Lecture Notes in Computer Science, 2001.
28. Y. Zhang and V. Paxson. Detecting Stepping Stones. In Proc. 9th USENIX Security Symposium, pages 171-184. The USENIX Association, 2000.