Abstract

There is currently need for an up-to-date and thorough survey of the research in the eld of computer and network intrusion detection. This paper presents such a survey, with a taxonomy of intrusion detection system features, and a classi- cation of the surveyed systems according to the taxonomy. The conclusion is reached that current research interest should lie in the study of the e ectiveness of intrusion detection and how to handle attacks against the intrusion detection system itself.

Citations

562	Bro: A system for detecting network intruders in real-time - Paxson - 1999
363	An intrusion-detection model - Denning - 1986
340	A Secure Environment for Untrusted Helper Applications - Goldberg, Wagner, et al. - 1996
279	Detecting intrusions using system calls: Alternative data models - Warrender, Forrest, et al. - 1999
245	Insertion, evasion, and denial of service: Eluding network intrusion detection - Ptacek, Newsham - 1998
237	Computer Security Threat Monitoring and Surveillance - Anderson
204	Network intrusion detection - Mukherjee, Heberlein, et al. - 1994
149	Execution Monitoring of Security-Critical Programs in Distributed Systems: A SpecificationBased Approach - Ko, Ruschitzka, et al. - 1997
128	An Architecture for Intrusion Detection using Autonomous Agents - Balasubramaniyan, Garcia-Fernandez, et al. - 1998
123	A network security monitor - HEBERLEIN, DIAS, et al. - 1990
123	Classification and detection of computer intrusions - Kumar - 1995
123	E.: A pattern matching model for misuse intrusion detection - Kumar, Spafford - 1994
113	USTAT: A real-time intrusion detection system for Unix - Ilgun
107	A neural network component for an intrusion detection system - Debar, Becker, et al. - 1992
104	Automated detection of vulnerabilities in privileged programs by execution monitoring - KO, FINK, et al. - 1994
92	intrusion detection system - Smaha, Haystack - 1988
81	The DIDS (distributed intrusion detection system) prototype - SNAPP, SMAHA, et al. - 1992
78	Towards a taxonomy of intrusion-detection systems - Debar, Dacier, et al. - 1999
76	Knowledge-based Intrusion Detection - Lunt, Jagannathan, et al. - 1989
74	Detection of anomalous computer session activity - Vaccaro, Liepins
72	Expert systems in intrusion detection: A case study - Sebring, Shellhouse, et al.
66	How to systematically classify computer security intrusions - Lindqvist, Jonsson - 1997
62	TCP WRAPPER: Network monitoring, access control, and booby traps. Paper presented at the 3rd UNIX Security Symposium - Venema - 1992
60	Detecting unusual program behavior using the statistical components of NIDES - ANDERSON, LUNT, et al. - 1995
60	Automated audit trail analysis and intrusion detection: A survey - LUNT - 1988
59	Artificial intelligence and intrusion detection: Current and future directions - Frank - 1994
59	NADIR “An automated system for detection network intrusion and misuse” , Cpmputers and Security - Jackson, Stallings, et al.
58	An Application of Pattern Matching in Intrusion Detection - KUMAR, SPAFFORD - 1994
40	Testing and evaluating computer intrusion detection systems - DURST, CHAMPION, et al. - 1999
24	T.: A real-time intrusion-detection expert system (ides - Lunt, Tamaru, et al. - 1992
22	Event monitoring enabling responses to anomalous live disturbances - EMERALD - 1997
21	An approach to UNIX security logging - Axelsson, Lindqvist, et al. - 1998
21	Architecture design of a scalable intrusion detection system for the emerging network infrastructure - Jou, Gong, et al. - 1997
17	Nextgeneration Intrusion-Detection Expert System (NIDES - Anderson, Frivold, et al. - 1995
16	P.G.: Requirements and Model for Ides–A Real-Time Intrusion Detection System - Denning, Neumann - 1985
14	Genetic algorithms: An alternative tool for security audit trails analysis - ME - 1992
11	A visual mathematical model for intrusion detection - Vert, McConnell, et al. - 1998
10	Udo W.: Cooperating security managers: Distributed intrusion detection systems - White, Pooch - 1996
9	Building a Security Monitor with Adaptive User Work Pro les - Halme, Kahn - 1988
9	GrIDS: A graph based intrusion detection system for large networks - Chen, Cheung, et al. - 1996
6	Intrusion detection: A survey - Esmaili, Safavi, et al. - 1995
6	Ides: The enhanced prototype, a real-time intrusion detection system - Lunt, Jagannathan, et al. - 1988
4	The computer watch data reduction tool - Dowel, Ramstedt - 1990
4	A Common Intrusion Detection Framework”, submitted to the Journal of Computer Security - Kahn, Porras, et al. - 2000
3	Cathy A Stallings. An expert system application for network intrusion detection - Jackson, DuBois - 1991
3	Live trac analysis of TCP/IP gateways - Porras, Valdes - 1998
2	AINT misbehaving|A taxonomy of anti-intrusion techniques - Halme, Bauer - 1995
2	A Kemmerer, and Phillip A Porras. State transition analysis: A rule-based intrusion detection approach - Ilgun, Richard - 1995
2	A software architechture to support misuse intrusion detection - Kumar, Spafford - 1995
2	Designing IDLE: The intrusion data library enterprise. Abstract presented at - Lindqvist, Moran, et al. - 1998