A Lightweight Tool for Detecting Web Server Attacks

Proceedings of the Symposium on Network and Distributed System Security, NDSS 2000

Volumn , Issue , 2000, Pages

  Almgren, Magnus ^a   Debar, Hervé ^a   Dacier, Marc ^a  

^a IBM RESEARCH ZURICH   (Switzerland)

Author keywords

[No Author keywords available]

Indexed keywords

INTRUSION DETECTION; NETWORK SECURITY; WEB SERVICES;

CGI SCRIPT; DETECTION TOOLS; INTRUSION-DETECTION; KEEP TRACK OF; MALICIOUS BEHAVIOR; PATTERN-MATCHING; REAL- TIME; SERVER ATTACKS; SIMPLE++; WEB SERVERS;

PATTERN MATCHING;

EID: 85180737978     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (16)

1. BERNERS-LEE, T., FIELDING, R. T., NIELSEN, H. F., GETTYS, J., AND MOGUL, J. Hypertext transfer protocol - HTTP/1.1. Internet Request for Comment RFC 2068, Jan. 1997.
2. CERT COORDINATION CENTER. Microsoft windowsbased web servers unauthorized access - long file names. Available by anonymous ftp from ftp.cert.org, February 1998.
3. CISCO SYSTEMS INC. NetRanger - Enterprise-scale, Real-time, Network Intrusion Detection System. 1998. Available from the company's website at http://www.cisco.com/warp/public/751/netranger/netrads.htm
4. DEBAR, H., DACIER, M., AND WESPI, A. Towards a taxonomy of intrusion detection systems. Computer Networks 31, 8 (April 1999), 805-822. Special issue on Computer Network Security.
5. FIELDING, R. wwwstat: Httpd logfile analysis software. November 1996. http://www.ics.uci.edu/pub/websoft/wwwstat/
6. GARFINKEL, S., AND SPAFFORD, G. Web Security & Commerce. O'Reilly & Associates, 1997.
7. HANSEN, S. E., AND ATKINS, E. T. Automated system monitoring and notification with swatch. In Proceedings of the seventh Systems Administration Conference (LISA '93) (Monterey, CA, November 1993).
8. INTERNET SECURITY SYSTEMS, INC. RealSecure.1997. Internet http://www.iss.net/prod/rsds.html
9. MUDGE@L0PHT.COM. test-cgi vulnerability in certain setups. April 1996. http://www.l0pht.com/advisories/test-cgi-vulnerability
10. NETWORK ASSOCIATES INC. Cybercop server. 1998. Available from the company's website at http://www.nai.com/products/security/cybercopsvr/index.asp
11. PAXSON, V. Bro: A system for detecting network intruders in real-time. In Proceedings of the 7th USENIX Security Symposium (San Antonio, TX, January 1998).
12. PTACEK, T. H., AND NEWSHAM, T. N. Insertion, evasion, and denial of service: Eluding network intrusion detection. Tech. rep., Secure Networks, Inc., Suite 330, 1201 5th Street S.W, Calgary, Alberta, Canada, T2R-0Y6, January 1998.
13. RANUM, M. J., LANDFIELD, K., STOLARCHUK, M., SIENKIEWICZ, M., LAMBETH, A., AND WALL, E. Implementing a generalized tool for network monitoring. In Proceedings of the Eleventh Systems Administration Conference (LISA '97) (San Diego, CA, October 1997).
14. RUBIN, A. D., GEER, D., AND RANUM, M. G. WEB Security Sourcebook. John Wiley and Sons, 1997.
15. TAYLOR, G. Autobuse. Internet, 1998. http://www.picante.com/~gtaylor/autobuse/
16. TUININGA, C., AND HOLAK, R. Logscanner. 1998. Internet http://logscanner.tradeservices.com/index.html