Related Work in Intrusion Detection

Conferences (Conferences in CS)

Call For Papers in Security Research
Calendar of events and CFP

Conference	Submission Deadline	Online Proceedings
IEEE Symposium on Security and Privacy (SP)	~Nov	IEEE Electronic Library (subscription needed) Free for Florida Tech users
USENIX Security Symposium (SEC)	~Jan	2008, 2007, 2006, 2005, 2004, 2003, 2002, 2001, 2000, 1999, 1998, 1996, 1995, 1993
ACM Conference on Computer and Communications Security (CCS)	~May	ACM Portal/Digital Library (subscription needed) Free for Florida Tech users
ISOC Network and Distributed System Security Symposium (NDSS)	~Aug	2009, 2008, 2007, 2006, 2005, 2004, 2003, 2002, 2001, 2000, 1999, 1998, 1997, 1996
Annual Computer Security Applications Conference (ACSAC)	~May	1998-...
International Symposium on Research in Attacks, Intrusions and Defenses (RAID)	~Mar
Computer Security Foundations Workshop (CSFW)	~Feb

Journals (Journals in CS)

Projects

EMERALD, SRI
Silicon Defense
STAT, UCSB
ICSI Center for Internet Research
Intrusion Detection Evaluation, MIT Lincoln Lab
Security Lab, Stanford

Papers

Survey

Mining System Audit Data: Opportunities and Challenges, W. Lee and W. Fan, SIGMOD Record 30(4):33-44, 2001.
Data Mining-based Intrusion Detectors: An Overview of the Columbia IDS Project, S. Stolfo, W. Lee, P. Chan, W. Fan & E. Eskin, SIGMOD Record, 30(4):5-14, 2001.
Research in Intrusion Detection Systems: A Survey, S. Axelsson. TR 98-17 (revised in 1999), Chalmers University of Technology, 1999.
Anomaly Detection
, ,
, ,
Cross-domain Collaborative Anomaly Detection: So Far Yet So Close, N. Boggs, S. Hiremagalore, A. Stavrou, and S. Stolfo Intl Conf. Recent Advances in Intrusion Detection (RAID), pp. 142-160, 2011.
Effective Anomaly Detection with Scarce Training Data, NDSS, 2010.
Spectrogram: A Mixture-of-Markov-Chains Model for Anomaly Detection in Web Traffic. Y. Song, A. Keromytis & S. Stolfo. Proc. Network & Distributed System Security Symposium (NDSS), 2009.
Behavior-Profile Clustering for False Alert Reduction in Anomaly Detection Sensors, Proc. Annual Computer Security Applications Conference (ACSAC), 2008.
Casting out Demons: Sanitizing Training Data for Anomaly Sensors, G. Cretu, A. Stavrou, M. Locasto, S. Stolfo & A. Keromytis. Proc. IEEE Symposium on Security & Privacy, 2008.
Using Generalization and Characterization Techniques in the Anomaly-based Detection of Web Attacks, W. Robertson, G. Vigna, C. Kruegel, R. Kemmerer, NDSS, 2006.
Anomalous Payload-based Worm Detection and Signature Generation, K. Wang, G. Cretu, S. Stolfo RAID, 2005.
On gray-box program tracking for anomaly detection, D. Gao, M. Reiter, D. Song USENIX Security Symp., 2004.
Anomaly Detection Using Layered Networks Based on Eigen Co-occurrence Matrix, M. Oka, Y. Oyama, H. Abe, and K. Kato, RAID, 2004.
Selection, Combination, and Evaluation of Effective Software Sensors for Detecting Abnormal Computer Usage, J. Shavlik & M. Shavlik, Tenth Intl Conf on Knowledge Discovery and Data Mining, 2004.
Anomalous Payload-based Network Intrusion Detection, K. Wang & S. Stolfo, RAID, 2004.
Seurat: A Pointillist Approach to Anomaly Detection, Y. Xie, H. Kim, D. O'Hallaron, M. Reiter, and Hui Zhang, RAID, 2004.
A Tamper-Resistant Framework for Unambiguous Detection of Attacks in User Space Using Process Monitors, R. Chinchani, S. Upadhyaya & K. Kwiat, IEEE International Workshop on Information Assurance, Darmstadt, Germany, March 2003.
Anomaly Detection Using Call Stack Information, H. Feng, O. Kolesnikov, P. Fogla, W. Lee & W. Gong, IEEE S&P, 2003.
An Approach for Detecting Self-Propagating Email Using Anomaly Detection, A. Gupta & R. Sekar, RAID, 2003.
Cross-Feature Analysis for Detecting Ad-hoc Routing Anomalies, Y. Huang, W. Fan, W. Lee, P. Yu, Proc. 23rd Intl. Conf. on Distributed Computing Systems, 2003.
Bayesian Event Classification for Intrusion Detection, C. Kruegel, D. Mutz, W. Robertson & F. Valeur, 19th ACSAC, 2003.
Topology-based Detection of Anomalous BGP Messages, C. Kruegel, D. Mutz, W. Robertson & F. Valeur, RAID, 2003.
On the Detection of Anomalous System Call Arguments, C. Kruegel, D. Mutz, F. Valeur & G. Vigna, 8th European Symposium on Research in Computer Security (ESORICS), 2003
Using decision trees to improve signature-based intrusion detection, C. Kruegel & T. Toth, RAID, 2003.
Anomaly Detection of Web-based Attacks, C. Kruegel and G. Vigna, ACM CCS, 2003.
A comparative study of anomaly detection schemes in network intrusion detection, A. Lazarevic, L. Ertoz, A. Ozgur, J. Srivastava & V. Kumar. Proc. SIAM Conf. Data Mining, 2003.
Probabilistic Tree and Automata for Application Behavior Modeling, G. Mazeroff, V. De Cerqueira, J. Gregor, and M. Thomason, Proc. 41st ACM Southeast Regional Conference, 2003.
Finding the vocabulary of program behavior data for anomaly detection, C. Michael, Proc. DISCEX, 2003.
Learning Attack Strategies from Intrusion Alerts, P. Ning & D. Xu, ACM CCS, 2003.
Detecting Anomalous Network Traffic with Self-Organizing Maps, M. Ramadas, S. Ostermann & B. Tjaden, RAID, 2003.
Surveillance detection in high bandwidth environments, S. Robertson, E. Siegel, M. Miller & S. Stolfo, Proc. DISCEX, 2003.
Detecting novel scans through pattern anomaly detection, A. Valdes, Proc. DISCEX, 2003.
Detecting malicious software by monitoring anomlaous windows registry accesses, F. Apap, A. Honig, S. Hershkop, E. Eskin & S. Stolfo. In Proc. Fifth Intl. Symp. Recent Advances in Intrusion Detection (RAID), 2002
MET: An Experimental System for Malicious Email Tracking, M. Bhattacharyya, M. Schultz, E. Eskin, S. Hershkop & S. Stolfo. In Proc. 2002 New Security Paradigms Workshop (NSPW), 2002.
Towards the scalable implementation of a user level anomaly detection system, R. Chinchani, S. Upadhyaya & K. Kwiat, IEEE MILCOM 2002.
A Geometric Framework for Unsupervised Anomaly Detection: Detecting Intrusions in Unlabeled Data, E. Eskin, A. Arnold, M, Prerau, L. Portnoy & S. Stolfo. In D. Barbara and S. Jajodia (editors), Applications of Data Mining in Computer Security, Kluwer, 2002.
Tracking down software bugs using automatic anomaly detection S. Hangal and M. Lam, Intl Conf Soft Eng, 2002.
Considering Both Intra-pattern and Inter-pattern Anomalies in Intrusion Detection, N. Jiang, K. Hua & S. Sheu, ICDM, 2002.
Service Specific Anomaly Detection for Network Intrusion Detection, C. Krugel, T. Toth & E. Kirda, ACM Symposium on Applied Computing, 2002.
Anomaly Detection in Embedded Systems R. Maxion & K. Tan. IEEE Transactions on Computers, Vol. 51, No. 2, pp. 108-120, 2002.
Specification Based Anomaly Detection: A New Approach for Detecting Network Intrusions, R. Sekar, A. Gupta, J. Frullo, T. Shanbhag, A. Tiwari, H. Yang & S. Zhou, ACM CCS, 2002.
Practical Automated Detection of Stealthy Portscans, S. Staniford, J. Hoagland, J. McAlerney. J. Computer Security, 2002.
"Why 6?" Defining the Operational Limits of stide, K. Tan & R. Maxion. IEEE Symposium on Security & Privacy, pp. 188-201, 2002.
Information-Theoretic Measures for Anomaly Detection, W. Lee and D. Xiang, IEEE Symposium on Security and Privacy, 2001.
Watcher: The Missing Piece of the Security Puzzle, J. Munson & S. Wimer, ACSAC, 2001.
A Fast Automation-based Method for Detecting Anomalous Program Behavior, R. Sekar, M. Bendre, D. Dhurjati & P. Bollineni. IEEE Security & Privacy Symp., 2001.
An analytical framework for reasoning about intrusions, S. Upadhyaya, R. Chinchani & K. Kwiat, IEEE Symposium on Reliable Distributed Systems, pp. 99-108, 2001.
Intrusion Detection via Static Analysis, D. Wagner & D. Dean. IEEE Security & Privacy Symp., 2001.
Discovering Outlier Filtering Rules from Unlabeled Data, K. Yamanishi & J. Takeuchi. KDD, 2001.
Temporal Signatures of Intrusion Detection, A. Jones & S. Li. 17th Annual Conf. Comp. Sec. App. Conf., p252-261, 2001.
Anomaly Detection over Noisy Data using Learned Probability Distributions, E. Eskin. Intl. Conf. Machine Learning, 2000.
Intrusion Detection with Unlabeled Data Using Clustering, L. Portnoy. Undergraduate Thesis, Columbia University, 2000.
Intrusion detection using variable-length audit trail patterns, A. Wespi, M. Dacier & H. Debar, RAID, 2000.
On-line Unsupervised Outlier Detection Using Finite Mixtures with Discounting Learning Algorithms, K. Yamanishi, J. Takeuchi & G. Williams. KDD, p.320-324, 2000.
Temporal Sequence Learning and Data Reduction for Anomaly Detection, T. Lane & C. Brodley, ACM Trans. Info. and Sys. Security, 1999.
Detecting Intrusions Using System Calls: Alternative Data Models, C. Warrender, S. Forrest &. B Peralmutter. IEEE Security & Privacy Symp., 1999.
Detecting Unusual Program Behavior Using the Statistical Components of NIDES, Anderson, Lunt, Javits, Tamaru & Valdes. SRI Technical Report SRI-CRL-95-06, 1995.
Misuse/signature Detection
Automatic Generation and Analysis of NIDS Attacks, S. Rubin, S. Jha & B. Miller, ACSAC, 2004.
Static Analysis of Executables to Detect Malicious Patterns, M. Christodorescu & S. Jha, USENIX Security Symp., 2003.
Detecting Service Violations and DoS Attacks, A. Habib, M. Hefeeda & B. Bhargava, NDSS, 2003.
Using Decision Trees to Improve Signature-based Intrusion Detection, C. Kruegel & T. Toth, RAID, 2003.
Storage-based Intrusion Detection: Watching Storage Activity for Suspicious Behavior, A. Pennington, J. Strunk, J. Griffin, C. Soules, G. Goodson & G. Ganger, CMU-CS-02-179, 2002 (USENIX Security Symp. 03).
Masquerade Detection Using Truncated Command Lines, R. Maxion & T. Townsend, Intl. Conf. on Dependable Systems and Networks (DSN-02), pp. 219-228, 2002.
Toward Cost-Sensitive Modeling for Intrusion Detection and Response, W. Lee, W. Fan, M. Miller, S. Stolfo, E. Zadok, Journal of Computer Security, 10(1,2), 2002.
Inferring Internet Denial-of-Service Activity, D. Moore, G. Voelker & S. Savage. USENIX Security Symp, 2001.
An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks V. Paxson. Computer Communication Review 31(3), 2001.
Data Mining Methods for Detection of New Malicious Executables, M. Schultz, E. Eskin, E. Zadok & S. Stolfo. IEEE Security & Privacy Symp., 2001.
Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics, M. Handley, C. Kreibich & V. Paxson. USENIX Security Symp, 2001.
eXpert-BSM: A Host-based Intrusion Detection Solution for Sun Solaris, U. Lindqvist & P. Porras. 17th Annual Computer Security Applications Conference (ACSAC 2001), p. 240-251, 2001.
A Framework for Constructing Features and Models for Intrusion Detection Systems, W. Lee and S. Stolfo, ACM Transactions on Information and System Security, 3(4), 2000.
A Data Mining Framework for Building Intrusion Detection Models, W. Lee, S. Stolfo & K. Mok. IEEE Security & Privacy Symp., 1999.
Hybrid Detection and Correlation
Building Attack Scenarios through Integration of Complementary Alert Correlation Method P. Ning, D. Xu, C. Healey, and R. St. Amant, NDSS, 2004.
Correlating Intrusion Events and Building Attack Scenarios through Attack Graph Distances, S. Noel, E. Robertson & S. Jajodia, ACSAC, 2004.
Attack Plan Recognition and Prediction Using Causal Networks, X. Qin and W. Lee, ACSAC, 2004.
Alert Correlation through Triggering Events and Common Resources, D. Xu and P. Ning, ACSAC, 2004.
Alert correlation in a cooperative intrusion detection framework, F. Cuppens & A. Mi�ge. IEEE Symposium on Research in Security and Privacy, 2002.
Argus - A distributed network intrusion detection system, Intl. System Administration and Networking Conf., the Netherlands, 2002.
Use of Text Categorization Techniques for Intrusion Detection, Y. Liao and R. Vemuri. 11th USENIX Security Symposium, 2002.
Detecting Novel Network Intrusions Using Bayes Estimators, D. Barbara, N. Wu & S. Jajodia. SIAM Intl. Conf. Data Mining, 2001.
Probabilistic Alert Correlation, A. Valdes & K. Skinner. RAID, 2001.
Adaptive, Model-based Monitoring for Cyber Attack Detection RAID 2000, LNCS 1907, p80-92, Springer Verlag, 2000.
A Study in Using Neural Networks For Anomaly and Misuse Detection, A. Ghosh & A Schwartzbard, USENIX Security Symp, 1999.
Experience with EMERALD to Date, G. Neumann & P. Porras. First USENIX Workshop on Intrusion Detection and Network Monitoring, p. 73-80, 1999.
Live Traffic Analysis of TCP/IP Gateways, P. Porras & A. Valdes. Internet Society's Networks and Distributed Systems Security Symposium, 1998.
EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances, P. Porras & G. Neumann. 20th Nat. Info. Sys. Security Conf., 1997.
Architectural Issues
A Virtual Honeypot Framework N. Provos, 13th USENIX Security Symosium, San Diego, CA, August 2004.
A Virtual Machine Introspection Based Architecture for Intrusion Detection, T. Garfinkel & M. Rosenblum, NDSS, 2003.
Traps and Pitfalls: Practical Problems in System Call Interposition Based Security Tools, T. Garfinkel, NDSS, 2003.
Detecting Malicious Java Code Using Virtual Machine Auditing, S. Soman, C. Krintz & G. Vigna USENIX Security, 03.
Access Control
Access Control Based on Execution History, M. Abadi & C. Fournet NDSS, 2003.
Evaluation
1999 DARPA Intrusion Detection System Evaluation: Design and Procedures, J. Haines, R. Lippmann, D. Fried, E. Tran, S. Boswell & M. Zissman. MIT Lincoln Laboratory Technical Report TR-1062, 2001.
Windows NT Attacks for the Evaluation of Intrusion Detection Systems J. Korba. S.M. Thesis, Massachusetts Institute of Technology, 2000.
Analysis and Results of the 1999 DARPA Off-Line Intrusion Detection Evaluation, R. Lippmann, J. Haines, D. Fried, J. Korba, K. Das. Third Intl Workshop on Recent Advances in Intrusion Detection(RAID), 2000.
The 1999 DARPA Off-Line Intrusion Detection Evaluation, R. Lippmann, J. Haines, D. Fried, J. Korba, K. Das. Computer Networks, 34(4), p579-595, 2000.
Testing Intrusion Detection Systems: A Critique of the 1998 and 1999 DARPA Intrusion Detection System Evaluations as Performed by Lincoln Laboratory, J. McHugh, ACM Trans. Info. Sys. Security, 3(4):262-294, 2000.
Visualization
isualization techniques for probability-weighted tree and automata-based models, V. De Cerqueira, G. Mazeroff, J. Gregor, and M. Thomason, Proc. 41st ACM Southeast Regional Conference, 2003.
Description of Attacks
A taxonomy of computer worms, N. Weaver, V. Paxon, S. Staniford & R. Cunningham, CCS Workshop on Rapid Malcode (WORM), 2003.
Flash Crowds and Denial of Service Attacks: Characterization and Implications for CDNs and Web Sites, J. Jung, B. Krishnamurthy & M. Rabinovich, Intl Conf WWW, 2002.
What do we mean by Network Denial of Service, C. Shields. IEEE Workshop on Information Assurance and Security, 2002.
A Formal Framework and Evaluation Method for Network Denial of Service, C. Meadows. PCSFW: Proceedings of The 12th Computer Security Foundations Workshop, 1999.
Analysis of a Denial of Service Attack on TCP, C. Schuba, I. Krsul, M. Kuhn, E. Spafford, A. Sundaram, D. Zamboni. IEEE Symposium on Security and Privacy, 1997.

, ,

Philip Chan, pkc@cs.fit.edu

Last modified: Thu Mar 13 17:55:28 EDT 2008