ForNet: A distributed forensics network

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 2776, Issue , 2003, Pages 1-16

  Shanmugasundaram, Kulesh ^a   Memon, Nasir ^a   Savant, Anubhav ^a   Bronnimann, Herve ^a  

^a POLYTECHNIC UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER ARCHITECTURE; NETWORK ARCHITECTURE; NETWORK SECURITY;

DIGITAL FORENSIC; DISTRIBUTED NETWORKS; LOGGING MECHANISM; RELATED WORKS; RESEARCH ISSUES;

WIDE AREA NETWORKS;

EID: 35248838230     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-45215-7_1     Document Type: Article

References (40)

1. Axelsson, S.: Research in intrusion-detection systems: A survey. Technical Report No 98-17 (December 1998)
2. Axelsson, S.: The base-rate fallacy and its implications for the difficulty of intrusion detection. In Proceedings of the ACM Conference on Computer and Communication Security (November 1999)
3. Babcock, B., Babu, S., Datar, M., Motwani, R., and Widom, J.: Models and issues in data stream systems. In Symposium on Principles of Database Systems, Madison, Wisconsin, USA, ACM SIGMOD (June 2002)
4. Babcock, B., Datar, M., and Motwani, R.: Sampling from a moving window over streaming data. In Proceedings of 13th Annual ACM-SIAM Symposium on Discrete Algorithms (2002)
5. Babu, S., Subramanian, L., and Widom, J.: A data stream management system for network traffic management. In Workshop on Network-Related Data Management (2001)
6. Bellovin, S.M., Leech, M., and Taylor, T.: ICMP traceback messages. In Internet Draft draft-ietf-itrace-01.txt (Work in progress). IETF (Oct 2001)
7. Bhattacharyya, M., Hershkop, S., Eskin, E., and Stolfo, S.J.: Met: An experimental system for malicious email tracking. In Proceedings of the 2002 New Security Paradigms Workshop (NSPW-2002), Virginia Beach, VA (Sep 2002)
8. Bloom, B.: Space/time tradeoffs in in hash coding with allowable errors. In CACM (1970) 422-426
9. Broder, A. and Mitzenmatcher, M.: Network applications of bloom filters: A survey. In Annual Allerton Conference on Communication, Control, and Computing, Urbana-Champaign, Illinois, USA (October 2002)
10. Burch, H. and Cheswick, B.: Tracing anonymous packets to their approximate source. In Proc. USENIX LISA (Dec 2000)
11. Datar, M., Gionis, A., Indyk, P., and Motwani, R.: Maintaining stream statistics over sliding windows. In ACM Symposium on Discrete Algorithms (2001) 635-644
12. Dean, D., Franklin, M., and Stubblefield, A.: An algebraic approach to IP traceback. In Proceedings of NDSS (Feb 2001)
13. Debar, H., Dacier, M., and Wepsi, A.: A revised taxonomy for intrusion-detection systems. IBM Research Report (1999)
14. Domingos, P. and Hulten, G.: Mining high-speed data streams. In Proc. SIGKDD Int. Conf. Knowledge Discovery and Data Mining (2000)
15. Sanstorm Enterprises. Netintercept. http://www.sandstorm.com/products/netintercept/ (Feb 2003)
16. Frank, J.: Artificial intelligence and intrusion detection: Current and future directions. In Proceedings of the 17th National Computer Security Conference (1994)
17. Gibbons, P. and Matias, Y.: Synopsis data structures for massive data sets. In DIMACS: Series in Discrete Mathematics and Theoretical Computer Science: Special Issue on External Memory Algorithms and Visualization (1999)
18. Gilbert, K., Kotidis, Y., Muthukrishnan, S., and Strauss, M.: Surfing wavelets on streams: one pass summaries for approximate aggregate queries. In Proc. ACM Conf. Very Large Databases. VLDB (2001)
19. Guha, S., Koudas, N., and Shim, K.: Data streams and histograms. In Proc. ACM Symp. Theory Comput. STOC (2001)
20. Hulten, G., Spencer, L., and Domingos, P.: Mining time-changing data streams. In Proc. SIGKDD Int. Conf. Knowledge Discovery and Data Mining (2001)
21. Ilgun, K., Kemmerer, R.A., and Porras, P.A.: State transition analysis: A rule-based intrusion detection approach. IEEE Transactions on Software Engineering (March 1995)
22. Javitz, H.S. and Valdes, A.: The sri ides statistical anomaly detector. In Proceedings of the IEEE Symposium on Research in Security and Privacy (1991)
23. Kumar, S. and Spafford, E.H.: An application of pattern matching in intrusion detection. Purdue University Technical Report CSD-TR-94-013 (1994)
24. Mankin, A., Massey, D., Wu, C.L., Wu, S.F., and Zhang, L.: On design and evaluation of "intention-driven" ICMP traceback. In Proc. IEEE International Conference on Computer Communications and Networks (Oct 2001)
25. Manku, G.S., Rajagopalan, S., and Lindsay, B.G.: Approximate medians and other quantiles in one pass and with limited memory. In Proc. of the ACM Intl Conf. on Management of Data. SIGMOD (Jun 1998)
26. Manku, G.S., Rajagopalan, S., and Lindsay, B.G.: Random sampling techniques for space efficient online computation of order statistics of large datasets. In Proc. of the ACM Intl Conf. on Management of Data. SIGMOD (Jun 1999)
27. Mitchell, A. and Vigna, G.: Mnemosyne: Designing and implementing network short-term memory. In International Conference on Engineering of Complex Computer Systems. IEEE (Dec 2002)
28. Motwani, R., Widom, J., Arasu, A., Babcock, B., Babu, S., Datar, M., Manku, G., Olston, C., Rosenstein, J., and Varma, R.: Query processing, resource management, and approximation in a data stream management system. In Proc. of the 2003 Conference on Innovative Data Systems Research (CIDR) (Jan 2003)
29. Paxson, V.: Bro: A system for detecting network intruders in real-time. 7th Annual USENIX Security Symposium (January 1998)
30. Porras, P.A. and Peter G. Neumann: Emerald: Event monitoring enabling responses to anomalous live disturbances. In Proceedings of the National Information Systems Security Conference (1997)
31. Ptacek, T.H. and Newsham, T.N.: Insertion, evasion, and denial of service: Eluding network intrusion detection. Secure Networks, Inc. (January 1998)
32. Roberts, P.: Nai goes forensic with infinistream. In InfoWorld, http://www.infoworld.com/article/03/02/10/HNnai_1.html (Feb 2003)
33. Savage, S., Wetherall, D., Karlin, A., and Anderson, T.: Practical network support for IP traceback. In Proceedings of the 2000 ACM SIGCOMM Conference, Stockholm, Sweden (Aug 2000) 295-306
34. Shanmugasundaram, K., Memon, N., Savant, A., and Bronnimann, H.: Efficient monitoring and storage of payloads for network forensics. In Unpublished Manuscript (May 2003)
35. Shanmugasundaram, K., Memon, N., Savant, A., and Bronnimann, H.: Fornet: A distributed forensics system. In Unpublished Manuscript (May 2003)
36. Snoeren, A.C., Partridge, C., Sanchez, L.A., Jones, C.E., Tchakountio, F., Kent, S.T., and Strayer, W.T.: Hash-based IP traceback. In ACM SIGCOMM, San Diego, California, USA (August 2001)
37. Song, D. and Perrig, A.: Advanced and authenticated marking schemes for IP traceback. In IEEE Infocomm (2001)
38. Thaper, U., Guha, S., Indyk, P., and Koudas, N.: Dynamic multidimensional histograms. In Proc. ACM Int. Symp. on Management of Data. SIGMOD (2002)
39. Winter, R. and Auerbach, K.: The big time: 1998 winter vldb survey. Database Programming Design (August 1998)
40. Yasinsac, A. and Manzano, Y.: Policies to enhance computer and network forensics. In Workshop on Information Assurance and Security, United States Military Academy, West Point, NY, IEEE (Jun 2001)