CISCO SECURE INTRUSION DETECTION SYSTEM
CONTENTS APPROACHES IN ANOMALY-BASED NETWORK INTRUSION DETECTION SYSTEMS INTRODUCTION ANOMALY-BASED INTRUSION DETECTION SYSTEMS PAYLOAD-BASED VS HEADER-BASED APPROACHES SETTING UP AN ABS BUILDING THE MODEL SETTING THE THRESHOLD PAYL AND POSEIDON PAYL POSEIDON CONCLUSIONS APPENDIX PAYL ALGORITHM SOM ALGORITHM REFERENCES FORMAL SPECI?CATION FOR FAST AUTOMATIC PRO?LING OF PROGRAM BEHAVIOR RELATED WORKS METHODOLOGY CASE STUDY POP3 COMMANDS THE FSM (STEP 1) VSP SPECI?CATION FOR IPOP3D (STEP 2) COMPILING VSP (STEP 3) VISITING THE FSM1 (STEP 4) EXECUTING TRACES (STEP 5) USING THE METHODOLOGY TO CON?GURE REMUS RESULTS CONCLUDING REMARKS THE CRITICAL SYSTEM CALLS POSTGRES VSP SPECI?CATION LEARNING BEHAVIOR PRO?LES FROM NOISY SEQUENCES LEARNING BY ABSTRACTION REGULAR EXPRESSIONS STRING ALIGNMENT AND FLEXIBLE MATCHING THE LEARNING ALGORITHM ?S OPERATOR ?I OPERATOR BASIC LEARNING CYCLE RE?NEMENT CYCLE EVALUATION ON ARTI?CIAL TRACES MOTIF RECONSTRUCTION IN PRESENCE OF NOISE ASSESSING THE IN?UENCE OF ALPHABET SIZE AND MOTIF LENGTH DISCOVERING GRAPH STRUCTURED PATTERNS USER PRO?LING KEY PHRASE TYPING MODEL TEXT TYPING MODEL CONCLUSION CORRELATION ANALYSIS OF INTRUSION ALERTS APPROACHES BASED ON SIMILARITY BETWEEN ALERT ATTRIBUTES PROBABILISTIC ALERT CORRELATION STATISTICAL ANOMALY ANALYSIS TO DETECT STEALTHY PORTSCANS ROOT CAUSE ANALYSIS STATISTICAL CAUSALITY ANALYSIS BASED APPROACH ALERT CLUSTERING AND MERGING IN MIRADOR PROJECT APPROACHES BASED ON PREDE?NED ATTACK SCENARIOS AGGREGATION AND CORRELATION IN IBM/TIVOLI SYSTEMS CHRONICLES BASED APPROACH APPROACHES BASED ON PREREQUISITES AND CONSEQUENCES OF ATTACKS PRE-CONDITION/POST-CONDITION BASED APPROACH IN MIRADOR PROJECT A PREREQUISITE AND CONSEQUENCE BASED APPROACH ATTACK HYPOTHESIZING AND REASONING TECHNIQUES APPROACHES BASED ON MULTIPLE INFORMATION SOURCES MISSION-IMPACT-BASED APPROACH A DATA MODEL M2D2 FOR ALERT CORRELATION TRIGGERING EVENTS AND COMMON RESOURCES BASED APPROACH PRIVACY ISSUES IN ALERT CORRELATION AN APPROACH ON ALERT SHARING AND CORRELATION GENERALIZATION AND PERTURBATION BASED APPROACHES SUMMARY AN APPROACH TO PREVENTING, CORRELATING, AND PREDICTING MULTI-STEP NETWORK ATTACKS RELATED WORK PRELIMINARIES ATTACK GRAPH INTRUSION ALERT AND CORRELATION HARDENING NETWORK TO PREVENT MULTI-STEP INTRUSIONS A MOTIVATING EXAMPLE A GRAPH-BASED ALGORITHM FOR HARDENING A NETWORK MINIMUM-COST SOLUTIONS CORRELATING AND PREDICTING MULTI-STEP ATTACKS MOTIVATION QUEUE GRAPH-BASED ALERT CORRELATION HYPOTHESIZING MISSING ALERTS AND PREDICTING FUTURE ALERTS COMPRESSING RESULT GRAPHS EMPIRICAL RESULTS EFFECTIVENESS PERFORMANCE RESPONSE: BRIDGING THE LINK BETWEEN INTRUSION DETECTION ALERTS AND SECURITY POLICIES PROBLEM STATEMENT DOMAIN TERMINOLOGY INTRUSION PREVENTION AND RESPONSE COMPREHENSIVE APPROACH TO RESPONSE SECURITY POLICY FORMALISM CHOICE OF A SECURITY POLICY FORMALISM THE OR-BAC FORMALISM OR-BAC CONTEXTS PRESENTATION OF A USE CASE MODELLING OF THE USE CASE APPLYING OR-BAC FOR THREAT RESPONSE EXAMPLES OF THREAT CONTEXTS ATOMIC CONTEXTS COMPOSED CONTEXTS CONTEXT ACTIVATION CONTEXT DEACTIVATION IN?UENCE OF MAPPING ON THE RESPONSE STRATEGY THE THREAT RESPONSE SYSTEM SYSTEM ARCHITECTURE ALERT CORRELATION ENGINE (ACE) POLICY INSTANTIATION ENGINE (PIE) POLICY DECISION POINT (PDP) POLICY ENFORCEMENT POINT (PEP) FROM ALERTS TO NEW POLICIES SYNTACTIC MAPPING ENRICHMENT STRATEGY APPLICATION CASE STUDY: E-MAIL SERVER THREATS RELATED TO THE USE CASE THREAT ANALYSIS REVISED DESCRIPTION OF THE POLICY COMPONENTS DE?NITION OF THE SECURITY POLICY THE MAPPING PREDICATES ISSUES WITH THE APPROACH INTRUSION DETECTION AND REACTION: AN INTEGRATED APPROACH TO NETWORK SECURITY INTRUSION DETECTION SYSTEMS TRACEBACK THE PROPOSED FRAMEWORK AN ARCHITECTURE FOR INTRUSION DETECTION AN APPROACH TO INTRUSION DETECTION PERFORMANCE EVALUATION A DISTRIBUTED INTRUSION DETECTION SYSTEM PRIVACY ISSUES IN INTRUSION DETECTION INTRUSION REACTION: A SYSTEM FOR ATTACK SOURCE DETECTION THE ASSYST ARCHITECTURE ATTACK SESSIONS THE ASP PROTOCOL ASSYST: CASE STUDIES INTRUSION DETECTION SUBSYSTEM TRAF?C CLASSI?CATION AND INTRUSION REACTION ASSYST IMPLEMENTATION DETAILS ASP PROTOCOL IMPLEMENTATION DETAILS TESTING THE APPROACH CONCLUSIONS AND FUTURE WORK