Recent Advances in Intrusion Detection: 6th International Symposium, RAID 2003, Pittsburgh, PA, USA, September 8-10, 2003, Proceedings (Lecture Notes in Computer Science, 2820)

This book constitutes the refereed proceedings of the 6th International Symposium on Recent Advances in Intrusion Detection, RAID 2003, held in Pittsburgh, PA, USA in September 2003. The 13 revised full papers presented were carefully reviewed and selected from 44 submissions. The papers are organized in topical sections on network infrastructure, anomaly detection, modeling and specification, and IDS sensors. On behalf of the Program Committee, it is our pleasure to present to you the proceedings of the Sixth Symposium on Recent Advances in Intrusion Detection (RAID 2003). Theprogramcommitteereceived44fullpapersubmissionsfrom10countries. All submissions were carefully reviewed by at least three program committee members or additional intrusion detection experts according to the criteria of scienti?c novelty, importance to the ?eld, and technical quality. The program committee meeting was held in Berkeley, USA on May 14–15. Thirteen papers were selected for presentation and publication in the conference proceedings. The conference technical program included both fundamental research and practical issues, and was shaped around the following topics: network infr- tructure, anomaly detection, correlation, modeling and speci?cation, and sensor technologies. The slides presented by the authors are available on the RAID 2003 web site, http://www.raid-symposium.org/raid2003. We would like to thank the authors that submitted papers as well as the p- gram committee members and the additional reviewers who volunteered their time to create a quality program. In addition, we want to thank the Conf- ence General Chair, John McHugh, for organizing the conference in Pittsburgh, Joshua Haines for publicizing the conference, Don McGillen for ?nding support from our sponsors, and Christopher Kruegel for maintaining the RAID web site and preparing the conference proceedings. Special thanks go to our sponsors Cisco Systems and Symantec, who p- vided ?nancial support for student participation to the symposium, and to CERT/CMU for hosting the conference. Front Matter....Pages - Mitigating Distributed Denial of Service Attacks Using a Proportional-Integral-Derivative Controller....Pages 1-16 Topology-Based Detection of Anomalous BGP Messages....Pages 17-35 Detecting Anomalous Network Traffic with Self-organizing Maps....Pages 36-54 An Approach for Detecting Self-propagating Email Using Anomaly Detection....Pages 55-72 Statistical Causality Analysis of INFOSEC Alert Data....Pages 73-93 Correlation of Intrusion Symptoms: An Application of Chronicles....Pages 94-112 Modeling Computer Attacks: An Ontology for Intrusion Detection....Pages 113-135 Using Specification-Based Intrusion Detection for Automated Response....Pages 136-154 Characterizing the Performance of Network Intrusion Detection Sensors....Pages 155-172 Using Decision Trees to Improve Signature-Based Intrusion Detection....Pages 173-191 Ambiguity Resolution via Passive OS Fingerprinting....Pages 192-206 Two Sophisticated Techniques to Improve HMM-Based Intrusion Detection Systems....Pages 207-219 An Analysis of the 1999 DARPA/Lincoln Laboratory Evaluation Data for Network Anomaly Detection....Pages 220-237 Back Matter....Pages - Distributed Denial of Service (DDoS) attacks originate from multiple slave machines, each previously compromised by a worm or worm-like behavior [1].