Detecting network intrusions via a statistical analysis of network packet characteristics

Proceedings of the Annual Southeastern Symposium on System Theory

Volumn 2001-January, Issue , 2001, Pages 309-314

  Bykova, M ^a   Ostermann, S ^a   Tjaden, B ^a  

^a Ohio University   (United States)

Author keywords

Computer crashes; Computer science; Data analysis; Intrusion detection; IP networks; Modems; Monitoring; Performance analysis; Statistical analysis; TCPIP

Indexed keywords

COMPUTER SCIENCE; DATA REDUCTION; INTERNET; INTRUSION DETECTION; MODEMS; MONITORING; SYSTEM THEORY;

COMPUTER CRASHES; INFORMATION GATHERING; IP NETWORKS; NETWORK INTRUSIONS; NETWORK RESOURCE; PERFORMANCE ANALYSIS; STATISTICAL DATAS; TCPIP;

STATISTICAL METHODS;

EID: 84949942991     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SSST.2001.918537     Document Type: Conference Paper

References (19)

1. J. Allen, A. Christie, W. Fithen, J. McHugh, J. Pickel, and E. Stoner, "State of the Practice of Intrusion Detection Technologies", http://www.sei.cmu.edu/publications/documents/99.reports/ 99tr028/99tr028abstract.html, Jan. 2000.
2. R. Braden, "T/TCP - TCP Extension for Transactions Functional Specification", RFC 1644, Jul. 1994.
3. Cisco, The NetRanger Intrusion Detection System, http://www.cisco.com/warp/public/cc/pd/sqsw/sqidsz/index.shtml, 2000.
4. Fyodor, "Remote OS detection via TCP/IP Stack Fingerprinting", http://www.insecure.org/nmap/nmap-fingerprinting-article.html, Oct. 1998.
5. R. Gula, "How to Handle and Identify Network Probes", http://www.network-defense.com/papers/probes.txt, Apr. 1999.
6. Internet Security Systems, Real Secure Attack Signatures, http://documents.iss.net/literature/RealSecure/Signatures-5.0.pdf, 2000.
7. Internet Security Systems, Real Secure, http://documents.iss.net/literature/RealSecure/rs-guide.pdf, 1999.
8. V. Jacobson, traceroute, ftp://ftp.ee.lbl.gov, 1989.
9. V. Jacobson, C. Leres, and S. DMcCanne, tcpdump, http://www.tcpdump.org, Jun. 1989.
10. S. McCanne, C. Leres, and V. Jacobson, libpcap, http://www.tcpdump.org, Jun. 1994.
11. S. Ostermann, tcptrace, http://www.tcptrace.org, 1994.
12. V. Paxson, "Bro: A System for Detection Network Intruders in Real-Time", Computer Networks, 31(23-24), pp. 2435-2463, 14 Dec. 1999.
13. J. Postel, "Internet Protocol", RFC 791, Sep. 1981.
14. J. Postel, "Transmission Control Protocol", RFC 793, Sep. 1981.
15. Y. Rekhter, B. Moskowitz, D. Karrenberd, G. J. de Groot, and E. Lear, "Address Allocation for Private Internets", RFC 1918, Feb. 1996.
16. J. Reynolds and J. Postel, "Assigned Numbers", RFC 1700, Oct. 1994.
17. R. Sekar, Y. Guang, S. Verma, and T. Shanbhag, "A High-Performance Network Intrusion Detection System", in Proceedings of the 6th ACM conference on Computer and communications security, pp. 8-17, 1999.
18. Symantec, NetProwler, http://enterprisesecurity.symantec.com/products, 2000.
19. B. Tjaden, L. Welch, S. Ostermann, D. Chelberg, R. Balupari, M. Bykova, M. Delaney, A. Mitchell, S. Li, D. Lissitsyn, and L. Tong, "INBOUNDS: The Integrated NetworkBased Ohio University Network Detective Service", 4th World Multiconference on Systemics, Cybernetics, and Informatics (SCI'2000), Jul. 2000.