Language-Based Generation and Evaluation of NIDS Signatures

Authors:
Shai Rubin;Somesh Jha;Barton P. Miller
Affiliations:
University of Wisconsin, Madison;University of Wisconsin, Madison;University of Wisconsin, Madison
Venue:
SP '05 Proceedings of the 2005 IEEE Symposium on Security and Privacy
Year:
2005

Citing 0
Cited 10

On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits

Proceedings of the 12th ACM conference on Computer and communications security
Protomatching network traffic for high throughputnetwork intrusion detection

Proceedings of the 13th ACM conference on Computer and communications security
Evading network anomaly detection systems: formal reasoning and practical techniques

Proceedings of the 13th ACM conference on Computer and communications security
Fast Signature Matching Using Extended Finite Automaton (XFA)

ICISS '08 Proceedings of the 4th International Conference on Information Systems Security
Enhancing Intrusion Detection System with proximity information

International Journal of Security and Networks
Fast, memory-efficient regular expression matching with NFA-OBDDs

Computer Networks: The International Journal of Computer and Telecommunications Networking
Simplifying signature engineering by reuse

ETRICS'06 Proceedings of the 2006 international conference on Emerging Trends in Information and Communication Security
Detecting unknown network attacks using language models

DIMVA'06 Proceedings of the Third international conference on Detection of Intrusions and Malware & Vulnerability Assessment
Understanding mutable internet pathogens, or how i learned to stop worrying and love parasitic behavior

ICISS'05 Proceedings of the First international conference on Information Systems Security
Towards systematic signature testing

TestCom'07/FATES'07 Proceedings of the 19th IFIP TC6/WG6.1 international conference, and 7th international conference on Testing of Software and Communicating Systems

Quantified Score

Hi-index	0.00

Visualization

Abstract

Host-based intrusion detection systems attempt to identify attacks by discovering program behaviors that deviate from expected patterns. While the idea of performing behavior validation on-the-fly and terminating errant tasks as soon as a violation is ...