Extending the DARPA off-line intrusion detection evaluations

Proceedings - DARPA Information Survivability Conference and Exposition II, DISCEX 2001

Volumn 1, Issue , 2001, Pages 35-45

  Haines, J W ^a   Rossey, L M ^a   Lippmann, R P ^a   Cunningham, R K ^a  

^a MASSACHUSETTS INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CRIME; MERCURY (METAL);

ATOMIC ATTACK; ATTACK SCENARIOS; BACKGROUND TRAFFIC; CORRELATION TESTS; INTRUSION DETECTION SYSTEMS; MULTIPLE COMPONENTS; PROOF OF CONCEPT; REAL-TIME INFORMATION;

INTRUSION DETECTION;

EID: 84964526751     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/DISCEX.2001.932190     Document Type: Conference Paper

References (22)

1. R. Lippmann, J. Haines, D. Fried, J. Korba, K. Das, "The 1999 DARPA off-line intrusion detection evaluation," Computer Networks, 34, 2000, 579-595.
2. R. P. Lippmann and J. Haines "Analysis and Results of the 1999 DARPA Off-Line Intrusion Detection Evaluation" in Recent Advances in Intrusion Detection, Third International Workshop, RAID 2000 Toulouse, France, October 2000, Proceedings. H. Debar, L. Me and S. F. Wu, (Eds.) Springer Verlag. Lectures in Computer Science Vol. 1907, 2000, pp. 162-182.
3. N. Puketza, K. Zhang, M. Chung, B. Mukherjee, and R. A. Olsson, "A methodology for testing intrusion detection systems," IEEE Transactions on Software Engineering, 22, 1996, pp. 719-729.
4. N. Puketza, M. Chung, R. A. Olsson, and B. Mukherjee, "A Software Platform for Testing Intrusion Detection Systems," IEEE Software, September/October, 1997, pp 43-51.
5. Richard P. Lippmann, David J. Fried, Isaac Graf, Joshua W. Haines, Kristopher R. Kendall, David McClung, Dan Weber, Seth E. Webster, Dan Wyschogrod, Robert K. Cunningham, and Marc A. Zissman, "Evaluating Intrusion Detection Systems: the 1998 DARPA Off-Line Intrusion Detection Evaluation", in Proceedings of the 2000 DARPA Information Survivability Conference and Exposition (DISCEX), Vol. 2, January 2000, IEEE Press.
6. http://www.ll.mit.edu/IST/ideval/index.html
7. B. Wood and R. Duggan, "Red-Teaming of Advanced Information Assurance Concepts," Proceedings of DARPA Information Survivability Conference and Exposition, Hilton Head, SC, Jan. 25-27, 2000
8. G. Schudel and B. Wood, "Modeling Behavior of the Cyber-Terrorist," submitted for consideration by the 2000 IEEE Symposium on Security and Privacy.
9. Solaris sadmind vulnerability: http://www.securityfocus.com/frames/?content=/vdb/bottom.html%3Fvid%3D866
10. Mstream DDoS tool: http://www.securityfocus.com/archive/82/57690
11. http://www.ietf.org/html.charters/idwg-charter.html
12. T. H. Ptacek and T. N. Newsham, "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection", Secure Networks, Inc. Report, January 1998.
13. J. Haines, R. Lippmann, D. Fried, J. Korba, and K. Das, "Design and Procedures of the 1999 DARPA Off-Line Intrusion Detection Evaluation", MIT Lincoln Laboratory Technical Report, In Press, December 2000.
14. J. Korba, "Windows NT Attacks for the Evaluation of Intrusion Detection Systems", S.M. Thesis, MIT Department of Electrical Engineering and Computer Science, June 2000.
15. K. Das, "The Development of Stealthy Attacks to Evaluate Intrusion Detection Systems", S.M. Thesis, MIT Department of Electrical Engineering and Computer Science, June 2000.
16. K. Kendall, "A Database of Computer Attacks for the Evaluation of Intussion Detection Systems", S.M. Thesis, MIT Department of Electrical Engineering and Computer Science, June 1999.
17. The Lawrence Berkeley National Laboratory Network Research Group provides tcpdump at http://www-nrg.ee.lbl.gov/.
18. The Linux modification is available from Skaion Corporation: terry@skaion.com or steve@skaion.com.
19. D. Alessandri, "Using Rule-Based Activity Descriptions to Evaluate Intrusion Detection Systems," in Recent Advances in Intrusion Detection, Third International Workshop, RAID 2000 Toulouse, France, October 2000, Proceedings. H. Debar, L. Me and S. F. Wu, (Eds.) Springer Verlag. Lectures in Computer Science Vol. 1907, 2000, pp. 183-196.
20. http://www.nmap.org
21. R. Durst, T. Champion, B. Witten, E. Miller, and L. Spagnuolo, "Testing and evaluating computer intrusion detection systems", Communications of the ACM, 42(7), pp. 53-61 (1999)
22. Send email to lariat@sst.ll.mit.edu for information