Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.最新文献

A game theoretic approach to modeling intrusion detection in mobile ad hoc networks 移动自组织网络中入侵检测建模的博弈论方法

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437828

A. Patcha, J.-M. Park

引用次数: 102

The Manuka project 麦卢卡项目

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437833

B. Endicott-Popovsky, D. Dittrich, A. Phillips, D. Frincke, J. Chavez, W. J. Gibbons, D. Nguyen, C. Seifert, A. Shephard, C. Abate, S. Loveland

{"title":"The Manuka project","authors":"B. Endicott-Popovsky, D. Dittrich, A. Phillips, D. Frincke, J. Chavez, W. J. Gibbons, D. Nguyen, C. Seifert, A. Shephard, C. Abate, S. Loveland","doi":"10.1109/IAW.2004.1437833","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437833","url":null,"abstract":"During 2003-2004, the University of Washington (UW) and Seattle University (SU) collaborated to build a system for cataloging compromised system images under the auspices of the Pacific Northwest Honeynet (PNW-honeynet) which is a Honeynet Project Research Alliance member group. The idea grew from the Honeynet Project's 'Forensic Challenge', a project designed to raise awareness, teach and inform those tasked with responding to threats of malicious network intrusion. Since teaching from evidence of actual incidents is far more powerful than the traditional approach of using contrived workbook exercises, the Manuka project called for the creation of a database that would store compromised system images for use in incident response and computer forensic courses. This is a case study of that development process, identifying the unique challenges overcome in completing Manuka by June, 2004. As an open source product that will be made available to the research and teaching community, it is hoped that through this paper interest will be stimulated to provide these researchers further ideas for use and enhancement.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"09 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115021576","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Anomaly intrusion detection using one class SVM 一类支持向量机的异常入侵检测

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437839

Yanxin Wang, Johnny Wong, A. Miner

引用次数: 148

Honeyfiles: deceptive files for intrusion detection Honeyfiles:用于入侵检测的欺骗文件

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437806

Jim Yuill, M. Zappe, D. Denning, F. Feer

引用次数: 146

Advancing assurance for secure distributed communications 推进安全分布式通信保障

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437832

G. Bella, Stefano Bistarelli

引用次数: 0

Misleading attackers with deception 用欺骗误导攻击者

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437794

F. Cohen, D. Koike

引用次数: 18

The application of a low pass filter in anomaly network intrusion detection 低通滤波器在异常网络入侵检测中的应用

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437826

Jun Li, C. Manikopoulos

{"title":"The application of a low pass filter in anomaly network intrusion detection","authors":"Jun Li, C. Manikopoulos","doi":"10.1109/IAW.2004.1437826","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437826","url":null,"abstract":"A common method of identifying attacks with anomaly network intrusion detection system (NIDS) is to detect significant deviations in network traffic compared to normal conditions. Such changes may include unexpected high traffic volume, caused by, for example, a denial of service (DoS) attack. However, recent research on traffic engineering has demonstrated that modern data network traffic exhibits high burstiness at a wide range of observation window sizes, i.e., self-similarity (V. Paxon et al., 1995, W.E. Leland et al., 1994), The self-similar traffic may challenge the traditional anomaly NIDS by making it unable to distinguish attacks from traffic bursts. In this paper, we investigate the employment of low pass filters in the anomaly NIDS to smooth the burstiness in network traffic measurements and thus reduce the false alarms. We studied the use of the MWA filter and the Savitzky-Golay filter. By analyzing the resulting network traffic measurements, we found out that the MWA filter significantly changed, while the Savitzky-Golay filter only moderately altered, the statistical properties of the network traffic measurements. To investigate the effectiveness of a low pass filter on anomaly NIDS, we applied the low pass filter to our anomaly NIDS, namely, the MIB anomaly intrusion detection (MAID) system. By employing these filters in MAID, we observed that the Savitzky-Golay filter outperforms the MWA filter. The results of the performance evaluation process also demonstrated that the low pass filter can significantly enhance the detection capacity of MAID, by reducing its false alarm rate.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130759165","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Anomalous packet identification for network intrusion detection 网络入侵检测中的异常报文识别

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437798

D. Summerville, N. Nwanze, V. Skormin

{"title":"Anomalous packet identification for network intrusion detection","authors":"D. Summerville, N. Nwanze, V. Skormin","doi":"10.1109/IAW.2004.1437798","DOIUrl":"https://doi.org/10.1109/IAW.2004.1437798","url":null,"abstract":"A packet-level anomaly detection system for network intrusion detection in high-bandwidth network environments is described. The approach is intended for hardware implementation and could be included in the network interface, switch or firewall. Efficient implementation in software on a network host is also possible. Network traffic is characterized using a novel technique that maps packet-level payloads onto a set of counters using bit-pattern hash functions, which were chosen for their implementation efficiency in both hardware and software. Machine learning is accomplished by mapping unlabelled training data onto a set of two-dimensional grids and forming a set of bitmaps that identify anomalous and normal regions. These bitmaps are used as the classifiers for real-time detection. The proposed method is extremely efficient in both the offline machine learning and real-time detection components and has the potential to provide accurate detection performance due to the ability of the bitmaps to capture nearly arbitrary shaped regions in the feature space. Results of a preliminary study are presented that demonstrate the effectiveness of the technique.","PeriodicalId":141403,"journal":{"name":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004.","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2004-06-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128272367","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 9

Investigation of pushback based detection and prevention of network bandwidth attacks 基于推回的网络带宽攻击检测与预防研究

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437847

Ningning Wu, Jing Zhang

引用次数: 2

Secure communications in ad hoc networks 自组织网络中的安全通信

Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004. Pub Date : 2004-06-10 DOI: 10.1109/IAW.2004.1437822

M. Burmester, T. Van Le

引用次数: 7