Understanding Intrusion Detection Through Visualization

Table of contents Foreword by Dr. John McHugh, Canada Research Chair, Director, Privacy and Security Laboratory, Dalhousie University Halifax, N.S. Canada.- Preface.- Introduction.- An Introduction to Intrusion Detection.- The Base-Rate Fallacy and the Difficulty of Intrusion Detection.- Visualising Intrusions: Watching the Webserver.- Combining a Bayesian Classifier with Visualisation.- Visualising the Inner Workings of a Self Learning Classifier.- Visualisation for Intrusion Detection: Hooking the Worm.- References.- Author Index.- Index.

[1]  Stefan Axelsson,et al.  An Approach to UNIX Security Logging , 1998 .

[2]  Paul Helman,et al.  Statistical Foundations of Audit Trail Analysis for the Detection of Computer Misuse , 1993, IEEE Trans. Software Eng..

[3]  Stefan Axelsson.  Visualisation for Intrusion Detection Hooking the Worm , 2003 .

[4]  Salvatore J. Stolfo,et al.  Toward Cost-Sensitive Modeling for Intrusion Detection and Response , 2002, J. Comput. Secur..

[5]  Erland Jonsson,et al.  An integrated framework for security and dependability , 1998, NSPW '98.

[6]  Thomas Henry Ptacek,et al.  Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection , 1998 .

[7]  Carla E. Brodley,et al.  Temporal sequence learning and data reduction for anomaly detection , 1998, CCS '98.

[8]  Ben Shneiderman,et al.  Readings in information visualization - using vision to think , 1999 .

[9]  Yifan Li,et al.  VisFlowConnect: netflow visualizations of link relationships for security situational awareness , 2004, VizSEC/DMSEC '04.

[10]  Marc Wilikens.  RAID 98 : First International Workshop on the Recent Advances in Intrusion Detection , 1998 .

[11]  Dieter Gollmann.  On the Verification of Cryptographic Protocols - A Tale of Two Committees , 2000, Electron. Notes Theor. Comput. Sci..

[12]  W. Yerazunis.  The Spam-Filtering Accuracy Plateau at 99 . 9 % Accuracy and How to Get Past It . , .

[13]  Tony A. Meyer,et al.  SpamBayes: Effective open-source, Bayesian based, email classification system , 2004, CEAS.

[14]  Prasert Kanthamanon,et al.  Hybrid Neural Networks for Intrusion Detection System , 2002 .

[15]  Erland Jonsson,et al.  How to systematically classify computer security intrusions , 1997, S&P 1997.

[16]  John C. McEachen,et al.  Conversation exchange dynamics for real-time network monitoring and anomaly detection , 2004, Second IEEE International Information Assurance Workshop, 2004. Proceedings..

[17]  Stefan Axelsson.  A Preliminary Attempt to Apply Detection and Estimation Theory to Intrusion Detection , 2007 .

[18]  Van Trees,et al.  Detection, estimation, and linear modulation theory , 1968 .

[19]  Stefan Axelsson,et al.  The base-rate fallacy and the difficulty of intrusion detection , 2000, TSEC.

[20]  Dominique Brodbeck,et al.  A Visual Approach for Monitoring Logs , 1998, LISA.

[21]  Stefan Axelsson,et al.  Combining a bayesian classifier with visualisation: understanding the IDS , 2004, VizSEC/DMSEC '04.

[22]  Philip K. Chan,et al.  Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security , 2004, CCS 2004.

[23]  Roy A. Maxion,et al.  Masquerade detection using enriched command lines , 2003, 2003 International Conference on Dependable Systems and Networks, 2003. Proceedings..

[24]  Salvatore J. Stolfo,et al.  A data mining framework for building intrusion detection models , 1999, Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344).

[25]  Kwan-Liu Ma,et al.  Case study: Interactive visualization for Internet security , 2002, IEEE Visualization, 2002. VIS 2002..

[26]  Deborah A. Frincke,et al.  Intrusion and Misuse Detection in Large-Scale Systems , 2002, IEEE Computer Graphics and Applications.

[27]  Heiko Stamer.  Verification of Cryptographic Protocols , 2005 .

[28]  J. G. Hollands,et al.  Engineering Psychology and Human Performance , 1984 .

[29]  Catherine A. Meadows.  An outline of a taxonomy of computer security research and development , 1993, NSPW '92-93.

[30]  Harold Joseph Highland,et al.  The 17th NSCS abstructArtificial Intelligence and Intrusion Detection: Current and Future Directions : Jeremy Frank, University of California, Davis, CA , 1995 .

[31]  Alfred Inselberg,et al.  Multidimensional detective , 1997, Proceedings of VIZ '97: Visualization Conference, Information Visualization Symposium and Parallel Rendering Symposium.

[32]  D. Frincke,et al.  A Visual Mathematical Model for Intrusion Detection , 1998 .

[33]  Stefan Axelsson,et al.  Visualising the Inner Workings of a Self Learning Classifier: Improving the Usability of Intrusion Detection Systems∗ , 2004 .

[34]  Shawn Ostermann,et al.  Detecting Anomalous Network Traffic with Self-organizing Maps , 2003, RAID.

[35]  Luc Girardin.  An Eye on Network Intruder-Administrator Shootouts , 1999, Workshop on Intrusion Detection and Network Monitoring.

[36]  Kymie M. C. Tan,et al.  A defense-centric taxonomy based on attack manifestations , 2004, International Conference on Dependable Systems and Networks, 2004.

[37]  Carl E. Landwehr,et al.  A taxonomy of computer program security flaws , 1993, CSUR.

[38]  Emilie Lundin Barse.  Logging for Intrusion and Fraud Detection , 2004 .

[39]  Magnus Almgren,et al.  Consolidation and Evaluation of IDS Taxonomies , 2003 .

[40]  Erland Jonsson,et al.  An Approach to UNIX Security Logging 1 , 1998 .

[41]  Stefan Axelsson.  Visualising Intrusions: Watching the Webserver , 2004, SEC.

[42]  M.I. Heywood,et al.  Host-based intrusion detection using self-organizing maps , 2002, Proceedings of the 2002 International Joint Conference on Neural Networks. IJCNN'02 (Cat. No.02CH37290).

[43]  Harold Joseph Highland,et al.  AIN'T misbehaving—A taxonomy of anti-intrusion techniques , 1995 .

[44]  Erland Jonsson,et al.  Extracting attack manifestations to determine log data requirements for intrusion detection , 2004, 20th Annual Computer Security Applications Conference.

[45]  Kwan-Liu Ma,et al.  Combining visual and automated data mining for near-real-time anomaly detection and analysis in BGP , 2004, VizSEC/DMSEC '04.

[46]  AxelssonStefan.  The base-rate fallacy and the difficulty of intrusion detection , 2000 .