Attacks against privileged applications can be detected by analyzing the stream of system calls issued during process execution. In the last few years, several approaches have been...
Darren Mutz, William K. Robertson, Giovanni Vigna,...
Abstract. In this work we present a NIDS cluster as a scalable solution for realizing high-performance, stateful network intrusion detection on commodity hardware. The design addre...
Matthias Vallentin, Robin Sommer, Jason Lee, Craig...
Abstract. Many host-based anomaly detection systems monitor process execution at the granularity of system calls. Other recently proposed schemes instead verify the destinations of...
Monirul I. Sharif, Kapil Singh, Jonathon T. Giffin...
Spyware infections are becoming extremely pervasive, posing a grave threat to Internet users’ privacy. Control of such an epidemic is increasingly difficult for the existing def...
We present a novel approach to remote traffic aggregation for Network Intrusion Detection Systems (NIDS) called Cooperative Selective Wormholing (CSW). Our approach works by select...
Much data access occurs via HTTP, which is becoming a universal transport protocol. Because of this, it has become a common exploit target and several HTTP specific IDSs have been...
Abstract. As research in automatic signature generators (ASGs) receives more attention, various attacks against these systems are being identified. One of these attacks is the “...
Network-level emulation has recently been proposed as a method for the accurate detection of previously unknown polymorphic code injection attacks. In this paper, we extend network...
Michalis Polychronakis, Kostas G. Anagnostakis, Ev...
In recent years, web applications have become tremendously popular, and nowadays they are routinely used in security-critical environments, such as medical, financial, and milita...
Marco Cova, Davide Balzarotti, Viktoria Felmetsger...