Recent Advances in Intrusion Detection: 8th International Symposium, RAID 2005, Seattle, WA, USA, September 7-9, 2005, Revised Papers (Lecture Notes in Computer Science (3858))

On behalf of the Program Committee, it is our pleasure to present the proceedings of the 8th Symposium on Recent Advances in Intrusion Detection (RAID 2005), which took place in Seattle, Washington, USA, September 7-9, 2005. The symposium brought together leading researchers and practitioners from academia, government and industry to discuss intrusion detection from research as well as commercial prospectives. We also encouraged discussions that addressed issues that arise when studying intrusion detection, including monitoring, performance and validation, from a wider perspective. We had sessions on the detection and containment of Internet worm attacks, anomaly detection, automated response to intrusions, host-based intrusion detection using system calls, network intrusion detection, and intrusion detection, in mobile wireless networks. The RAID 2005 Program Committee received 83 paper submissions from all over the world. All submissions were carefully reviewed by several members of Program Committee and selection was made on the basis of scientific novelty, importance to the field, and technical quality. Final selection took place at a Program Committee meeting held on May 11 and 12 in Oakland, California. Fifteen papers and two practical experience reports were selected for presentation and publication in the conference proceedings. The keynote address was given by Phil Attfield of the Northwest Security Institute. Virtual Playgrounds For Worm Behavior Investigation / Xuxian Jiang [and Others] -- Empirical Analysis Of Rate Limiting Mechanisms / Cynthia Wong [and Others] -- Cots Diversity Based Intrusion Detection And Application To Web Servers / Eric Totel, Frederic Majorczyk, Ludovic Me -- Behavioral Distance For Intrusion Detection / Debin Gao, Michael K. Reiter, Dawn Song -- Flips : Hybrid Adaptive Intrusion Prevention / Michael E. Locasto [and Others] -- Towards Software-based Signature Detection For Intrusion Prevention On The Network Card / H. Bos, Kaiming Huang -- Defending Against Injection Attacks Through Context-sensitive String Evaluation / Tadeusz Pietraszek [and Others] -- On Random-inspection-based Intrusion Detection / Simon P. Chung, Aloysius K. Mok -- Environment-sensitive Intrusion Detection / Jonathon T. Giffin [and Others] -- Polymorphic Worm Detection Using Structural Information Of Executables / Christopher Kruegel -- Anomalous Payload-based Worm Detection And Signature Generation / Ke Wang, Gabriela Cretu, Salvatore J. Stolfo -- On Interactive Internet Traffic Replay / Seung-sun Hong, S. Felix Wu -- Interactive Visualization For Network And Port Scan Detection / Chris Muelder, Kwan-liu Ma, Tony Bartoletti -- A Fast Static Analysis Approach To Detect Exploit Code Inside Network Flows / Ramkumar Chinchani, Eric Van Den Berg -- Sequence Number-based Mac Address Spoof Detection / Fanglu Guo, Tzi-cker Chiueh -- A Specification-based Intrusion Detection Model For Olsr / Chinyang Henry Tseng [and Others]. Alfonso Valdes, Diego Zamboni (eds.). Includes Bibliographical References And Index. Frontmatter Worm Detection and Containment (I) Virtual Playgrounds for Worm Behavior Investigation Empirical Analysis of Rate Limiting Mechanisms Anomaly Detection COTS Diversity Based Intrusion Detection and Application to Web Servers Behavioral Distance for Intrusion Detection Intrusion Prevention and Response FLIPS: Hybrid Adaptive Intrusion Prevention Towards Software-Based Signature Detection for Intrusion Prevention on the Network Card Defending Against Injection Attacks Through Context-Sensitive String Evaluation System Call-Based Intrusion Detection Improving Host-Based IDS with Argument Abstraction to Prevent Mimicry Attacks On Random-Inspection-Based Intrusion Detection Environment-Sensitive Intrusion Detection Worm Detection and Containment (II) Polymorphic Worm Detection Using Structural Information of Executables Anomalous Payload-Based Worm Detection and Signature Generation Network-Based Intrusion Detection On Interactive Internet Traffic Replay Interactive Visualization for Network and Port Scan Detection A Fast Static Analysis Approach to Detect Exploit Code Inside Network Flows Mobile and Wireless Networks Sequence Number-Based MAC Address Spoof Detection A Specification-Based Intrusion Detection Model for OLSR Backmatter Annotation This book constitutes the refereed proceedings of the 8th International Symposium on Recent Advances in Intrusion Detection held in September 2005. The 15 revised full papers and two practical experience reports were carefully reviewed and selected from 83 submissions. The papers are organized in topical sections on worm detection and containment, anomaly detection, intrusion prevention and response, intrusion detection based on system calls and network-based, as well as intrusion detection in mobile and wireless networks