On the self-similarity of synthetic traffic for the evaluation of intrusion detection systems

Proceedings - 2003 Symposium on Applications and the Internet, SAINT 2003

Volumn , Issue , 2003, Pages 242-248

  Allen, W H ^a   Marin, G A ^a  

^a UNIVERSITY OF CENTRAL FLORIDA   (United States)

Author keywords

Character generation; Computer science; Force measurement; Intrusion detection; IP networks; Local area networks; Protocols; Telecommunication traffic; Testing; Traffic control

Indexed keywords

COMPUTER SCIENCE; FORCE MEASUREMENT; INSPECTION EQUIPMENT; INTERNET; INTERNET PROTOCOLS; LOCAL AREA NETWORKS; MERCURY (METAL); NETWORK PROTOCOLS; TELECOMMUNICATION TRAFFIC; TESTING; TRAFFIC CONTROL;

CHARACTER GENERATION; INTRUSION DETECTION SYSTEMS; IP NETWORKS; PARTIAL EVALUATION; REAL NETWORK DATUM; SELF-SIMILARITIES; SIMULATED ATTACKS; STATISTICAL PROPERTIES;

INTRUSION DETECTION;

EID: 84943421730     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SAINT.2003.1183056     Document Type: Conference Paper

References (17)

1. J. Beran. Statistics for Long-Memory Processes. Chapman and Hall, 1994.
2. J. Beran, R. Sherman, M. Taqqu, and W. Willinger. Long-range dependence in variable-bit-rate video traffic. IEEE Transactions on Communications, 43(2), Feb-Apr 1995.
3. J. Cabrera, B. Ravichandran, and R. Mehra. Statistical traffic modeling for network intrusion detection. In Proceedings, 8th IEEE Symposium on Modeling, Analysis and Simulation of Computers and Telecommunications, 2000.
4. M. Crovella and A. Bestavros. Self-similarity in World Wide Web traffic: Evidence and possible causes. IEEE-ACM Transactions on Networking, 5(6), Dec 1997.
5. J. Haines, R. Lippmann, D. Fried, et al. 1999 DARPA intrusion detection evaluation: Design and procedures. Lincoln Laboratory Technical Report 1062, Massachusetts Institute of Technology, 2001.
6. J. Haines, L. Rossey, and R. Lippmann. Extending the DARPA off-line intrusion detection evaluations. In Proceedings, IEEE DARPA Information Survivability Conference and Exposition (DISCEX II), 2001.
7. V. Jacobson, C. Leres, and S. McCanne. tcpdump, a network packet capture program. www.tcpdump.org, 1989.
8. M. L. Laboratory. Intrusion detection evaluation web site. www.ll.mit.edu/IST/ideval, 2002.
9. W.-C. Lau, A. Erramilli, J. Wang, and W. Willinger. Self-similar traffic generation: The random midpoint displacement algorithm and its properties. In Proceedings, IEEE International Conference on Communications, 1995.
10. W. Leland, M. Taqqu, W. Willinger, and D. Wilson. On the self-similar nature of Ethernet traffic (extended version). IEEE-ACM Transactions on Networking, 2(1), Feb 1994.
11. M. Li, W. Jia, and W. Zhao. Decision analysis of network-based intrusion detection systems for denial-of-service attacks. In Proceedings, IEEE Conferences on Info-tech and Info-net, 2001.
12. R. Lippmann, J. Haines, D. Fried, et al. The 1999 DARPA off-line intrusion detection evaluation. Computer Networks, 34, 2000.
13. D. Nash and D. Ragsdale. Simulation of self-similarity in network utilization patterns as a precursor to automated testing of intrusion detection systems. IEEE Transactions on Systems, Man and Cybernetics, Part A: Systems and Humans, 31(4), 2001.
14. F. Neri. Comparing local search with respect to genetic evolution to detect intrusions in computer networks. In Proceedings, Congress on Evolutionary Computation, 2000.
15. V. Paxson. Fast approximation of self-similar network traffic. Technical report LBL-36750, Lawrence Berkley Laboratory, 1995.
16. V. Paxson and S. Floyd. Wide-area traffic: The failure of Poisson modeling. IEEE-ACM Transactions on Networking, 3(3), June 1995.
17. P. Uppuluri and R. Sekar. Experiences with specification-based intrusion detection. In Proceedings, Recent Advances in Intrusion Detection (RAID 2001), Oct 2001.