Intrusion detection systems are fundamentally passive and fail–open. Because their primary task is classification, they do nothing to prevent an attack from succeeding. An intru...
Michael E. Locasto, Ke Wang, Angelos D. Keromytis,...
Abstract. Network worms are malicious programs that spread automatically across networks by exploiting vulnerabilities that affect a large number of hosts. Because of the speed at...
New features of the PAYL anomalous payload detection sensor are demonstrated to accurately detect and generate signatures for zero-day worms. Experimental evidence demonstrates tha...
To detect and defend against Internet worms, researchers have long hoped to have a safe convenient environment to unleash and run real-world worms for close observation of their in...
Xuxian Jiang, Dongyan Xu, Helen J. Wang, Eugene H....
Abstract. It is commonly accepted that intrusion detection systems (IDS) are required to compensate for the insufficient security mechanisms that are available on computer systems...
Abstract. The exponential growth in the deployment of IEEE 802.11based wireless LAN (WLAN) in enterprises and homes makes WLAN an attractive target for attackers. Attacks that expl...
We perform host-based intrusion detection by constructing a model from a program’s binary code and then restricting the program’s execution by the model. We improve the effecti...
Jonathon T. Giffin, David Dagon, Somesh Jha, Wenke...
We introduce a notion, behavioral distance, for evaluating the extent to which processes—potentially running different programs and executing on different platforms—behave si...
Abstract. Injection vulnerabilities pose a major threat to applicationlevel security. Some of the more common types are SQL injection, crosssite scripting and shell injection vulne...