Analysis of the 1999 DARPA/Lincoln Laboratory IDS Evaluation Data with NetADHICT

IEEE Symposium on Computational Intelligence for Security and Defense Applications, CISDA 2009

Volumn , Issue , 2009, Pages

  Brown, Carson ^a   Cowperthwaite, Alex ^a   Hijazi, Abdulrahman ^a   Somayaji, Anil ^a  

^a CARLETON UNIVERSITY   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

NETWORKING COMMUNITY; TEMPORAL VARIATION;

ARTIFICIAL INTELLIGENCE;

INTRUSION DETECTION;

EID: 77950566663     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CISDA.2009.5356522     Document Type: Conference Paper

References (13)

1. J. W. Haines, R. P. Lippmann, D. J. Fried, M. A. Zissman, and E. Tran. 1999 DARPA intrusion detection evaluation: Design and procedures. Technical Report TR-1062, MIT Lincoln Laboratory Technical Report, 2001.
2. A. Hijazi, H. Inoue, A. Matrawy, P. van Oorschot, and A. Somayaji. Discovering packet structure through lightweight hierarchical clustering. Communications, 2008. ICC '08. IEEE International Conference on, pages 33-39, May 2008.
3. A. Hijazi, H. Inoue, A. Matrawy, P. van Oorschot, and A. Somayaji. Lightweight hierarchical clustering of network packets using (p, n)-grams. Technical Report TR-09-03, School of Computer Science, Carleton University, February 2009.
4. Information and Computer Science, University of California, Irvine. KDD Cup 1999 data, 1999. http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html.
5. H. Inoue, D. Jansens, A. Hijazi, and A. Somayaji. NetADHICT: A tool for understanding network traffic. In Proceedings of the 21st Large Installation System Administration Conference (LISA'07), Nov 2007.
6. Lincoln Laboratory, MIT. DARPA intrusion detection data sets, 2008. http://www.ll.mit.edu/mission/communications/ist/corpora/ideval/data/index.html.
7. R. Lippmann, J. W. Haines, D. J. Fried, J. Korba, and K. Das. The 1999 darpa off-line intrusion detection evaluation. Computer Networks, 34(4):579 - 595, 2000. Recent Advances in Intrusion Detection Systems.
8. M. Mahoney and P. Chan. Learning rules for anomaly detection of hostile network traffic. pages 601-604, Nov. 2003.
9. M. V. Mahoney and P. K. Chan. An analysis of the 1999 DARPA/Lincoln Laboratory evaluation data for network anomaly detection. In Proceedings of the Sixth International Symposium on Recent Advances in Intrusion Detection, pages 220-237. Springer-Verlag, 2003.
10. J. McHugh. Testing intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory. ACM Trans. Inf. Syst. Secur., 3(4):262-294, 2000.
11. L. Portnoy, E. Eskin, and S. Stolfo. Intrusion detection with unlabeled data using clustering. In In Proceedings of ACM CSS Workshop on Data Mining Applied to Security (DMSA-2001), pages 5-8, 2001.
12. K. Wang and S. J. Stolfo. Recent Advances in Intrusion Detection, chapter Anomalous Payload-Based Network Intrusion Detection, pages 203-222. 2004.
13. K. Xinidis, I. Charitakis, S. Antonatos, K. Anagnostakis, and E. Markatos. An active splitter architecture for intrusion detection and prevention. Dependable and Secure Computing, IEEE Transactions on, 3(1):31-44, Jan.-March 2006.