Recent Advances in Intrusion Detection: 5th International Symposium, RAID 2002, Zurich, Switzerland, October 16-18, 2002, Proceedings (Lecture Notes in Computer Science)

On Behalf Of The Program Committee, It Is Our Pleasure To Present To You The Proceedings Of The Fifth Symposium On Recent Advances In Intrusion Detection (raid). Since Its ?rst Edition In 1998, Raid Has Established Itself As The Main Annual Intrusion Detection Event, Attracting Researchers, Practitioners, And V- Dors From All Over The World. The Raid 2002 Program Committee Received 81 Submissions (64 Full Papers And 17 Extended Abstracts) From 20 Countries. This Is About 50% More Than Last Year. All Submissions Were Carefully Reviewed By At Least Three Program Comm- Tee Members Or Additional Intrusion-detection Experts According To The Criteria Ofscienti?cnovelty,importancetothe?eld,andtechnicalquality.finalselection Took Place At A Meeting Held On May 15–16, 2002, In Oakland, Usa. Sixteen Full Papers Were Selected For Presentation And Publication In The Conference Proc- Dings. In Addition, Three Extended Abstracts Of Work In Progress Were Selected For Presentation. The Program Included Both Fundamental Research And Practical Issues. The Seven Sessions Were Devoted To The Following Topics: Anomaly Detection, Steppi- Stonedetection,correlationofintrusion-detectionalarms,assessmentofintrusi- Detectionsystems,intrusiontolerance,legalaspects,adaptiveintrusion-detection Systems, And Intrusion-detection Analysis. Raid 2002 Also Hosted A Panel On “cybercrime,” A Topic Of Major Concern For Both Security Experts And The Public. Marcus J. Ranum, The Founder Of Network Flight Recorder, Inc., Delivered A Keynote Speech Entitled “challenges For The Future Of Intrusion Detection”. Stepping Stone Detection -- Detecting Long Connection Chains Of Interactive Terminal Sessions -- Multiscale Stepping-stone Detection: Detecting Pairs Of Jittered Interactive Streams By Exploiting Maximum Tolerable Delay -- Detecting Malicious Software By Monitoring Anomalous Windows Registry Accesses -- Anomaly Detection -- Undermining An Anomaly-based Intrusion Detection System Using Common Exploits -- Correlation -- Analyzing Intensive Intrusion Alerts Via Correlation -- A Mission-impact-based Approach To Infosec Alarm Correlation -- M2d2: A Formal Data Model For Ids Alert Correlation -- Legal Aspects / Intrusion Tolerance -- Development Of A Legal Framework For Intrusion Detection -- Learning Unknown Attacks — A Start -- Assessment Of Intrusion Detection Systems -- Evaluation Of The Diagnostic Capabilities Of Commercial Intrusion Detection Systems -- A Stochastic Model For Intrusions -- Attacks Against Computer Network: Formal Grammar-based Framework And Simulation Tool -- Capacity Verification For High Speed Network Intrusion Detection Systems -- Adaptive Intrusion Detection Systems -- Performance Adaptation In Real-time Intrusion Detection Systems -- Intrusion Detection Analysis -- Accurate Buffer Overflow Detection Via Abstract Pay Load Execution -- Introducing Reference Flow Control For Detecting Intrusion Symptoms At The Os Level -- The Effect Of Identifying Vulnerabilities And Patching Software On The Utility Of Network Intrusion Detection. Andeas Wespi, Giovanni Vigna, Luca Deri (eds.) Includes Bibliographical References And Index. On behalf of the Program Committee, it is our pleasure to present to you the proceedings of the Sixth Symposium on Recent Advances in Intrusion Detection (RAID 2003). Theprogramcommitteereceived44fullpapersubmissionsfrom10countries. All submissions were carefully reviewed by at least three program committee members or additional intrusion detection experts according to the criteria of scienti?c novelty, importance to the ?eld, and technical quality. The program committee meeting was held in Berkeley, USA on May 14–15. Thirteen papers were selected for presentation and publication in the conference proceedings. The conference technical program included both fundamental research and practical issues, and was shaped around the following topics: network infr- tructure, anomaly detection, correlation, modeling and speci?cation, and sensor technologies. The slides presented by the authors are available on the RAID 2003 web site, http://www.raid-symposium.org/raid2003. We would like to thank the authors that submitted papers as well as the p- gram committee members and the additional reviewers who volunteered their time to create a quality program. In addition, we want to thank the Conf- ence General Chair, John McHugh, for organizing the conference in Pittsburgh, Joshua Haines for publicizing the conference, Don McGillen for ?nding support from our sponsors, and Christopher Kruegel for maintaining the RAID web site and preparing the conference proceedings. Special thanks go to our sponsors Cisco Systems and Symantec, who p- vided ?nancial support for student participation to the symposium, and to CERT/CMU for hosting the conference. Detecting Long Connection Chains of Interactive Terminal Sessions....Pages 1-16 Multiscale Stepping-Stone Detection: Detecting Pairs of Jittered Interactive Streams by Exploiting Maximum Tolerable Delay....Pages 17-35 Detecting Malicious Software by Monitoring Anomalous Windows Registry Accesses....Pages 36-53 Undermining an Anomaly-Based Intrusion Detection System Using Common Exploits....Pages 54-73 Analyzing Intensive Intrusion Alerts via Correlation....Pages 74-94 A Mission-Impact-Based Approach to INFOSEC Alarm Correlation....Pages 95-114 M2D2: A Formal Data Model for IDS Alert Correlation....Pages 115-137 Development of a Legal Framework for Intrusion Detection....Pages 138-157 Learning Unknown Attacks — A Start....Pages 158-176 Evaluation of the Diagnostic Capabilities of Commercial Intrusion Detection Systems....Pages 177-198 A Stochastic Model for Intrusions....Pages 199-218 Attacks against Computer Network: Formal Grammar-Based Framework and Simulation Tool....Pages 219-238 Capacity Verification for High Speed Network Intrusion Detection Systems....Pages 239-251 Performance Adaptation in Real-Time Intrusion Detection Systems....Pages 252-273 Accurate Buffer Overflow Detection via Abstract Pay load Execution....Pages 274-291 Introducing Reference Flow Control for Detecting Intrusion Symptoms at the OS Level....Pages 292-306 The Effect of Identifying Vulnerabilities and Patching Software on the Utility of Network Intrusion Detection....Pages 307-326 This book constitutes the refereed proceedings of the 5th International Symposium on Recent Advances in Intrusion Detection, RAID 2002, held in Zurich, Switzerland, in October 2002. The 16 revised full papers presented were carefully reviewed and selected from a total of 81 submissions. The papers are organized in topical sections on stepping stone detection, anomality detection, correlation, legal aspects and intrusion tolerance, assessment of intrusion detection systems, adaptive intrusion detection systems, intrusion detection analysis A book that constitutes the refereed proceedings of the 13th International Symposium on Recent Advances in Intrusion Detection, RAID 2010, that was held in Ottawa, Canada, in September 2010.