EXpert-BSM: A host-based intrusion detection solution for Sun Solaris

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn 2001-January, Issue , 2001, Pages 240-251

  Lindqvist, Ulf ^a   Porras, Phillip A ^a  

^a SRI INTERNATIONAL   (United States)

Author keywords

Data security; Electronic switching systems; Expert systems; Intrusion detection; Laboratories; Remote monitoring; Secure storage; Sun; Surveillance; Trademarks

Indexed keywords

DIGITAL STORAGE; EXPERT SYSTEMS; KNOWLEDGE BASED SYSTEMS; LABORATORIES; MERCURY (METAL); NETWORK SECURITY; SECURITY OF DATA; SECURITY SYSTEMS; SPACE SURVEILLANCE; SUN; TRADEMARKS;

DECENTRALIZED MANAGEMENT; DIRECT MONITORING; ELECTRONIC SWITCHING SYSTEMS; HOST-BASED INTRUSION DETECTION; PRODUCTION ENVIRONMENTS; REMOTE MONITORING; SECONDARY STORAGE; SECURE STORAGE;

INTRUSION DETECTION;

EID: 84949211287     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ACSAC.2001.991540     Document Type: Conference Paper

References (23)

1. M. Bishop. A standard audit trail format. In Proceedings of the 18th National Information Systems Security Conference, pages 136-145, Baltimore, Maryland, Oct. 10-13, 1995. National Institute of Standards and Technology/National Computer Security Center
2. D. Bruschi, E. Rosti, and R. Banfi. A tool for pro-active defense against the buffer overrun attack. In J.-J. Quisquater et al., editors, Computer Security-Proceedings of ESORICS 98, volume 1485 of LNCS, pages 17-31, Louvainla-Neuve, Belgium, Sept. 16-18, 1998. Springer-Verlag
3. CERT Coordination Center, Software Engineering Institute, Carnegie Mellon University, Pittsburgh, PA 15213-3890, USA. Buffer Overflow in Sun Solstice AdminSuite Daemon sadmind, Dec. 14, 1999. CERT Advisory CA-1999-16, http: //www.cert.org/advisories/CA-1999-16.html
4. T. E. Daniels and E. H. Spafford. Identification of host audit data to detect attacks on low-level IP vulnerabilities. Journal of Computer Security, 7(1):3-35, 1999
5. J. de Haas. Vulnerability in Solaris ufsrestore. Bugtraq, June 14, 2000. http://archives.neohapsis.com/archives/ bugtraq/2000-06/0114.html
6. C. Flack and M. J. Atallah. Better logging through formality: Applying formal specification techniques to improve audit logs and log consumers. In H. Debar, L. Me, and S. F. Wu, editors, Recent Advances in Intrusion Detection (RAID 2000), volume 1907 of LNCS, pages 1-16, Toulouse, France, Oct. 2-4, 2000. Springer-Verlag
7. J. Habra, B. Le Charlier, A. Mounji, and I. Mathieu. ASAX: Software architecture and rule-based language for universal audit trail analysis. In Y. Deswarte et al., editors, Computer Security-Proceedings of ESORICS 92, volume 648 of LNCS, pages 435-450, Toulouse, France, Nov. 23-25, 1992. Springer-Verlag
8. L. T. Heberlein et al. A network security monitor. In Proceedings of the 1990 IEEE Symposium on Security and Privacy, pages 296-304, Oakland, California, May 7-9, 1990
9. K. Ilgun. USTAT: A real-time intrusion detection system for UNIX. In Proceedings of the 1993 IEEE Symposium on Security and Privacy, pages 16-28, Oakland, California, May 24-26, 1993
10. U. Lindqvist and P. A. Porras. Detecting computer and network misuse through the production-based expert system toolset (P-BEST). In Proceedings of the 1999 IEEE Symposium on Security and Privacy, pages 146-161, Oakland, California, May 9-12, 1999
11. R. Lippmann, J.W. Haines, D. J. Fried, J. Korba, and K. Das. Analysis and results of the 1999 DARPA off-line intrusion detection evaluation. In H. Debar, L. Me, and S. F. Wu, editors, Recent Advances in Intrusion Detection (RAID 2000), volume 1907 of LNCS, pages 162-182, Toulouse, France, Oct. 2-4, 2000. Springer-Verlag
12. A. Mounji. Languages and Tools for Rule-Based Distributed Intrusion Detection. PhD thesis, Institut d'Informatique, University of Namur, Belgium, Sept. 1997
13. P. G. Neumann and P. A. Porras. Experience with EMERALD to date. In Proceedings of the 1st Workshop on Intrusion Detection and Network Monitoring, Santa Clara, California, Apr. 9-12, 1999. The USENIX Association
14. A. One. Smashing the stack for fun and profit. Phrack Magazine, 7(49), Nov. 8, 1996. http://www.fc.net/phrack/files/ p49/p49-14
15. J. Picciotto. The design of an effective auditing subsystem. In Proceedings of the 1987 IEEE Symposium on Security and Privacy, pages 13-22, Oakland, California, Apr. 27-29, 1987
16. P. A. Porras and R. A. Kemmerer. Penetration state transition analysis: A rule-based intrusion detection approach. In Proceedings of the Eighth Annual Computer Security Applications Conference, pages 220-229, San Antonio, Texas, Nov. 30-Dec. 4, 1992
17. P. A. Porras and P. G. Neumann. EMERALD: Event monitoring enabling responses to anomalous live disturbances. In Proceedings of the 20th National Information Systems Security Conference, pages 353-365, Baltimore, Maryland, Oct. 7-10, 1997. National Institute of Standards and Technology/ National Computer Security Center
18. P. Proctor. Audit reduction and misuse detection in heterogeneous environments: Framework and application. In Proceedings of the Tenth Annual Computer Security Applications Conference, pages 117-125, Orlando, Florida, Dec. 5-9, 1994
19. T. H. Ptacek and T. N. Newsham. Insertion, evasion, and denial of service: Eluding network intrusion detection. Technical report, Secure Networks, Inc., Calgary, Alberta, Canada, Jan. 1998. http://www.clark.net/roesch/idspaper.html
20. M. M. Sebring, E. Shellhouse, M. E. Hanna, and R. A. Whitehurst. Expert systems in intrusion detection: A case study. In Proceedings of the 11th National Computer Security Conference, pages 74-81, Baltimore, Maryland, Oct. 17-20, 1988. National Institute of Standards and Technology/ National Computer Security Center
21. Sun Microsystems, Inc., 901 San Antonio Road, Palo Alto, CA 94303, USA. SunSHIELD Basic Security Module Guide, Solaris 7, Oct. 1998. Part No. 805-2635-10
22. U.S. Department of Defense. Trusted Computer System Evaluation Criteria, Dec. 1985. DoD 5200.28-STD
23. A. Valdes and K. Skinner. Adaptive, model-based monitoring for cyber attack detection. In H. Debar, L. Me, and S. F. Wu, editors, Recent Advances in Intrusion Detection (RAID 2000), volume 1907 of LNCS, pages 80-92, Toulouse, France, Oct. 2-4, 2000. Springer-Verlag