Host-based Intrusion Detection Systems (IDS) that rely on audit data exhibit a delay between attack execution and attack detection. A knowledgeable attacker can use this delay to d...
Network intrusion detection systems typically detect worms by examining packet or flow logs for known signatures. Not only does this approach mean worms cannot be detected until ...
Finding the cause for congested virtual private network (VPN) links that connect an office network over the Internet to remote subsidiaries can be a hassle. Scan traffic of worm i...
The outlier detection problem has important applications in the eld of fraud detection, network robustness analysis, and intrusion detection. Most such applications are high dimen...
The call stack of a program execution can be a very good information source for intrusion detection. There is no prior work on dynamically extracting information from call stack a...
Henry Hanping Feng, Oleg M. Kolesnikov, Prahlad Fo...