Detection of intrusions in information systems by sequential change-point methods

[1]  H Robbins,et al.  Complete Convergence and the Law of Large Numbers. , 1947, Proceedings of the National Academy of Sciences of the United States of America.

[2]  E. S. Page.  CONTINUOUS INSPECTION SCHEMES , 1954 .

[3]  A. Shiryaev.  On Optimum Methods in Quickest Detection Problems , 1963 .

[4]  G. Lorden.  PROCEDURES FOR REACTING TO A CHANGE IN DISTRIBUTION , 1971 .

[5]  T. Lai,et al.  Some one-sided theorems on the tail distribution of sample sums with applications to the last time and largest excess of boundary crossings , 1975 .

[6]  Alʹbert Nikolaevich Shiri︠a︡ev,et al.  Optimal stopping rules , 1977 .

[7]  M. Pollak.  Optimal Detection of a Change in Distribution , 1985 .

[8]  D. Siegmund.  Sequential Analysis: Tests and Confidence Intervals , 1985 .

[9]  G. Moustakides.  Optimal stopping times for detecting changes in distributions , 1986 .

[10]  J. Healy.  A note on multivariate CUSUM procedures , 1987 .

[11]  M. Woodroofe.  Nonlinear Renewal Theory in Sequential Analysis , 1987 .

[12]  B. Brodsky,et al.  Nonparametric Methods in Change Point Problems , 1993 .

[13]  Frank Feather,et al.  Fault detection in an Ethernet network using anomaly signature matching , 1993, SIGCOMM '93.

[14]  Michèle Basseville,et al.  Detection of abrupt changes: theory and application , 1993 .

[15]  Edward Carlstein,et al.  Change-point problems , 1994 .

[16]  Benjamin Yakir,et al.  Optimal detection of a change in distribution when the observations form a Markov chain with a finite state space , 1994 .

[17]  Rasul A. Khan.  Detecting changes in probabilities of a multi—component process , 1995 .

[18]  A. Tartakovsky.  ASYMPTOTIC PROPERTIES OF CUSUM AND SHIRYAEV'S PROCEDURES FOR DETECTING A CHANGE IN A NONHOMOGENEOUS GAUSSIAN PROCESS , 1995 .

[19]  T. Lai.  Sequential changepoint detection in quality control and dynamical systems , 1995 .

[20]  Michèle Basseville,et al.  Detection of Abrupt Changes: Theory and Applications. , 1995 .

[21]  Alexander Novikov,et al.  Statistics and control of random processes , 1995 .

[22]  Terry Dwain Escamilla,et al.  Intrusion detection: network security beyond the firewall , 1998 .

[23]  Tze Leung Lai,et al.  Information Bounds and Quick Detection of Parameter Changes in Stochastic Systems , 1998, IEEE Trans. Inf. Theory.

[24]  Terry Escamilla,et al.  Intrusion detection , 1998 .

[25]  Alexander G. Tartakovsky,et al.  Asymptotic Optimality of Certain Multihypothesis Sequential Tests: Non‐i.i.d. Case , 1998 .

[26]  Karen A. F. Copeland.  Cumulative Sum Charts and Charting for Quality Improvement , 1999 .

[27]  Venugopal V. Veeravalli,et al.  Multihypothesis sequential probability ratio tests - Part I: Asymptotic optimality , 1999, IEEE Trans. Inf. Theory.

[28]  Marc Dacier,et al.  Towards a taxonomy of intrusion-detection systems , 1999, Comput. Networks.

[29]  Venugopal V. Veeravalli,et al.  Multihypothesis sequential probability ratio tests - Part II: Accurate asymptotic expansions for the expected sample size , 2000, IEEE Trans. Inf. Theory.

[30]  S. Kent,et al.  On the trail of intrusions into information systems , 2000 .

[31]  Lee Garber,et al.  Denial-of-Service Attacks Rip the Internet , 2000, Computer.

[32]  Alexander G. Tartakovsky,et al.  A novel approach to detection of \denial{of{service" attacks via adaptive sequential and batch{sequential change{point detection methods , 2001 .

[33]  Elisabeth J. Umble,et al.  Cumulative Sum Charts and Charting for Quality Improvement , 2001, Technometrics.

[34]  Jonathan Lemon,et al.  Resisting SYN Flood DoS Attacks with a SYN Cache , 2002, BSDCon.

[35]  Kang G. Shin,et al.  Detecting SYN flooding attacks , 2002, Proceedings.Twenty-First Annual Joint Conference of the IEEE Computer and Communications Societies.

[36]  Cheng-Der Fuh,et al.  SPRT and CUSUM in hidden Markov models , 2003 .

[37]  C. Fuh.  Asymptotic operating characteristics of an optimal change point detection in hidden Markov models , 2004, math/0503682.

[38]  V. Veeravalli,et al.  General Asymptotic Bayesian Theory of Quickest Change Detection , 2005 .

[39]  A. Tartakovsky.  Asymptotic Performance of a Multichart CUSUM Test Under False Alarm Probability Constraint , 2005, Proceedings of the 44th IEEE Conference on Decision and Control.

[40]  Hongjoong Kim,et al.  A novel approach to detection of intrusions in computer networks via adaptive sequential and batch-sequential change-point detection methods , 2006, IEEE Transactions on Signal Processing.

[41]  A. Tartakovsky,et al.  A Nonparametric Multichart CUSUM Test for Rapid Intrusion Detection , 2007 .