When dealing with malware infections, one of the first tasks is to find the processes that were involved in the attack. We introduce Malfor, a system that isolates those process...
Abstract— A clear deficiency in most of todays Anomaly Intrusion Detection Systems (AIDS) is their inability to distinguish between a new form of legitimate normal behavior and ...
— Anomaly-based intrusion detection systems have the ability of detecting novel attacks, but in real-time detection, they face the challenges of producing many false alarms and f...
Alert correlation systems are post-processing modules that enable intrusion analysts to find important alerts and filter false positives efficiently from the output of Intrusion...
An intrusion-detection system (IDS) for an on-going attack is described. Prior to an attack, an IDS operates in anticipation of a general threat. During an attack, the IDS can dea...
Jim Yuill, Shyhtsun Felix Wu, Fengmin Gong, Ming-Y...