Designing and implementing a family of intrusion detection systems

Proceedings of the ACM SIGSOFT Symposium on the Foundations of Software Engineering

Volumn , Issue , 2003, Pages 88-97

  Vigna, Giovanni ^a   Valeur, Fredrik ^a   Kemmerer, Richard A ^a  

^a University of California   (United States)

Author keywords

intrusion detection; object oriented frameworks; program families; security

Indexed keywords

AD HOC APPROACH; ATTACK MODEL; DISTRIBUTED APPLICATIONS; EVENT STREAMS; HETEROGENEOUS ENVIRONMENTS; INTRUSION DETECTION SYSTEMS; MALICIOUS BEHAVIOR; MODELING FEATURES; MODELING LANGUAGES; NETWORKED SYSTEMS; OBJECT-ORIENTED FRAMEWORKS; PROGRAM FAMILIES; PROGRAM FAMILY; SOFTWARE FAMILY;

COMPUTER CRIME; COMPUTER SIMULATION LANGUAGES; COMPUTER SOFTWARE; LINGUISTICS; MATHEMATICAL MODELS; NETWORK SECURITY; QUERY LANGUAGES;

INTRUSION DETECTION;

EID: 77954507857     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/940071.940084     Document Type: Conference Paper

References (30)

1. Apache 2.0 Documentation, 2001. http://www.apache.org/.
2. D. Curry and H. Debar. Intrusion Detection Message Exchange Format: Extensible Markup Language (XML) Document Type Definition. draft-ietf-idwg- idmef-xml-06.txt, December 2001.
3. R. Durst, T. Champion, B. Witten, E. Miller, and L. Spagnuolo. Addendum to "Testing and Evaluating Computer Intrusion Detection Systems". CACM, 42(9):15, September 1999.
4. R. Durst, T. Champion, B. Witten, E. Miller, and L. Spagnuolo. Testing and Evaluating Computer Intrusion Detection Systems. CACM, 42(7):53-61, July 1999.
5. S. Eckmann, G. Vigna, and R. Kemmerer. STATL: An Attack Language for State-based Intrusion Detection. Journal of Computer Security, 10(1/2):71-104, 2002.
6. E. Gamma, R. Helm, R. Johnson, and J. Vlissides. Design Patterns. Addison-Wesley, 1995.
7. K. Ilgun. USTAT: A Real-time Intrusion Detection System for UNIX. Master's thesis, Computer Science Department, University of California, Santa Barbara, July 1992.
8. K. Ilgun. USTAT: A Real-time Intrusion Detection System for UNIX. In Proceedings of the IEEE Symposium on Research on Security and Privacy, Oakland, CA, May 1993.
9. K. Ilgun, R. Kemmerer, and P. Porras. State Transition Analysis: A Rule-Based Intrusion Detection System. IEEE Transactions on Software Engineering, 21(3):181-199, March 1995.
10. T. Inc. Building Object-Oriented Frameworks. White Paper, 1994.
11. Internet Security Systems. Introduction to RealSecure Version 3.0, January 1999.
12. Intersect Alliance. Snare: System Intrusion Analysis and Reporting Environment. http://www.intersectalliance.com/projects/Snare, August 2002.
13. ISS. Realsecure 7.0. http://www.iss.net/, August 2002.
14. R. Johnson and B. Foote. Designing Reusable classes. Journal of Object-Oriented Programming, 1(2):22-35, June/July 1988.
15. K. Kendall. A Database of Computer Attacks for the Evaluation of Intrusion Detection Systems. Master's thesis, MIT, June 1999.
16. D. Lange and M. Oshima. Programming and Deploying Java Mobile Agents with Aglets. Addison-Wesley, 1998.
17. R. Lippmann, D. Fried, I. Graf, J. Haines, K. Kendall, D. McClung, D. Weber, S. Webster, D. Wyschogrod, R. Cunningham, and M. Zissman. Evaluating Intrusion Detection Systems: The 1998 DARPA Off-line Intrusion Detection Evaluation. In Proceedings of the DARPA Information Survivability Conference and Exposition, Volume 2, Hilton Head, SC, January 2000.
18. P. Neumann and P. Porras. Experience with EMERALD to Date. In First USENIX Workshop on Intrusion Detection and Network Monitoring, pages 73-80, Santa Clara, California, April 1999.
19. NFR Security. Overview of NFR Network Intrusion Detection System, February 2001.
20. D. Parnas. The Design and Development of Program Families. IEEE Transactions on Software Engineering, March 1976.
21. C. Perkins and E. Royer. Ad hoc on-demand distance vector routing. In C. Perkins, editor, Ad hoc Networking. Addison-Wesley, 2000.
22. P. Porras. STAT - A State Transition Analysis Tool for Intrusion Detection. Master's thesis, Computer Science Department, University of California, Santa Barbara, June 1992.
23. P. Porras and P. Neumann. EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances. In Proceedings of the 1997 National Information Systems Security Conference, October 1997.
24. M. Ranum, K. Landfield, M. Stolarchuck, M. Sienkiewicz, A. Lambeth, and E. Wall. Implementing a Generalized Tool for Network Monitoring. In Eleventh Systems Administration Conference (LISA '97). USENIX, Oct. 1997.
25. M. Roesch. Snort - Lightweight Intrusion Detection for Networks. In Proceedings of the USENIX LISA '99 Conference, November 1999.
26. G. F. Rogers. Framework-Based Software Development in C++. Prentice-Hall, 1997.
27. Sun Microsystems, Inc. Installing, Administering, and Using the Basic Security Module. 2550 Garcia Ave., Mountain View, CA 94043, December 1991.
28. Y. Vandoorselaere. Prelude, an Hybrid Open Source Intrusion Detection System. http://www.prelude-ids.org/, August 2002.
29. th Annual Computer Security Application Conference, Scottsdale, Arizona, December 1998.
30. th International Symposium on Recent Advances in Intrusion Detection (RAID 2001), volume 2212 of LNCS, pages 69-84, Davis, CA, October 2001. Springer-Verlag.