Recent Advances in Intrusion Detection

1. Front Matter

   PDF

2. Modelling Process Behaviour

   1. Automatic Extraction of Accurate Application-Specific Sandboxing Policy

      • Lap Chung Lam, Tzi-cker Chiueh

      Pages 1-20

   2. Context Sensitive Anomaly Monitoring of Process Control Flow to Detect Mimicry Attacks and Impossible Paths

      • Haizhi Xu, Wenliang Du, Steve J. Chapin

      Pages 21-38

3. Detecting Worms and Viruses

   1. HoneyStat: Local Worm Detection Using Honeypots

      • David Dagon, Xinzhou Qin, Guofei Gu, Wenke Lee, Julian Grizzard, John Levine et al.

      Pages 39-58

   2. Fast Detection of Scanning Worm Infections

      • Stuart E. Schechter, Jaeyeon Jung, Arthur W. Berger

      Pages 59-81

   3. Detecting Unknown Massive Mailing Viruses Using Proactive Methods

      • Ruiqi Hu, Aloysius K. Mok

      Pages 82-101

4. Attack and Alert Analysis

   1. Using Adaptive Alert Classification to Reduce False Positives in Intrusion Detection

      • Tadeusz Pietraszek

      Pages 102-124

   2. Attack Analysis and Detection for Ad Hoc Routing Protocols

      • Yi-an Huang, Wenke Lee

      Pages 125-145

   3. On the Design and Use of Internet Sinks for Network Abuse Monitoring

      • Vinod Yegneswaran, Paul Barford, Dave Plonka

      Pages 146-165

5. Practical Experience

   1. Monitoring IDS Background Noise Using EWMA Control Charts and Alert Information

      • Jouni Viinikka, Hervé Debar

      Pages 166-187

   2. Symantec Deception Server Experience with a Commercial Deception System

      • Brian Hernacki, Jeremy Bennett, Thomas Lofgren

      Pages 188-202

6. Anomaly Detection

   1. Anomalous Payload-Based Network Intrusion Detection

      • Ke Wang, Salvatore J. Stolfo

      Pages 203-222

   2. Anomaly Detection Using Layered Networks Based on Eigen Co-occurrence Matrix

      • Mizuki Oka, Yoshihiro Oyama, Hirotake Abe, Kazuhiko Kato

      Pages 223-237

   3. Seurat: A Pointillist Approach to Anomaly Detection

      • Yinglian Xie, Hyang-Ah Kim, David R. O’Hallaron, Michael K. Reiter, Hui Zhang

      Pages 238-257

7. Formal Analysis for Intrusion Detection

   1. Detection of Interactive Stepping Stones: Algorithms and Confidence Bounds

      • Avrim Blum, Dawn Song, Shobha Venkataraman

      Pages 258-277

   2. Formal Reasoning About Intrusion Detection Systems

      • Tao Song, Calvin Ko, Jim Alves-Foss, Cui Zhang, Karl Levitt

      Pages 278-295

   3. RheoStat: Real-Time Risk Management

      • Ashish Gehani, Gershon Kedem

      Pages 296-314

8. Back Matter

   PDF

On behalf of the Program Committee, it is our pleasure to present to you the proceedings of the 7th Symposium on Recent Advances in Intrusion Detection (RAID 2004), which took place in Sophia-Antipolis, French Riviera, France, September 15–17, 2004. The symposium brought together leading researchers and practitioners from academia, government and industry to discuss intrusion detection from research as well as commercial perspectives. We also encouraged discussions that - dressed issues that arise when studying intrusion detection, including infor- tion gathering and monitoring, from a wider perspective. Thus, we had sessions on detection of worms and viruses, attack analysis, and practical experience reports. The RAID 2004 Program Committee received 118 paper submissions from all over the world. All submissions were carefully reviewed by several members of the Program Committee and selection was made on the basis of scienti?c novelty, importance to the ?eld, and technical quality. Final selection took place at a meeting held May 24 in Paris, France. Fourteen papers and two practical experience reports were selected for presentation and publication in the conf- ence proceedings. In addition, a number of papers describing work in progress were selected for presentation at the symposium. The keynote addresswas given by Bruce Schneier of Counterpane Systems. H? akan Kvarnstrom ¨ of TeliaSonera gave an invited talk on the topic “Fighting Fraud in Telecom Environments. ” A successful symposium is the result of the joint e?ort of many people.

• Information
• Internet
• Monitor
• RAID
• Routing
• anomality detection
• audit control
• cryptrographic attacks
• intrusion detection
• intrusion prevention
• log-data analysis
• network intrusion
• network security
• privacy
• security

• Department of Computer Science and Engineering, Chalmers University of Technology, Göteborg, Sweden

  Erland Jonsson, Magnus Almgren

• SRI International, Menlo Park, USA

  Alfonso Valdes

Policies and ethics