US 6,775,657 B1Grant
Multilayered intrusion detection system and method
Issue Date:2004-08-10
•23 Claims
•3 Drawing Sheets
Abstract
A multilayered intrusion detection system and method are disclosed. The method includes monitoring activity on a network and maintaining a registry of each host node address associated with a host node operable to perform host-based intrusion detection services. The method further includes comparing a destination address of the monitored network activity with at least one host node address in the registry. If an address of the network activity matches an address of a registered host node, the network activity is dismissed and allowed to proceed unencumbered to the registered host node. The network activity not destined for a registered host node has intrusion detection services performed on it. The network activity dismissed to the host node has intrusion detection services performed on it at the receiving host node.
Metadata
Assignee
- Cisco Technology, Inc.
Inventor
- Stephen M. Baker
Application Information
Application Number:US 09/471,508
Filing Date:1999-12-22
Priority Date:1999-12-22
Art Unit:7
Classifications
IPC:
G06F 1700H04L 932
Field of Search:
706 46706 45706 50713200713201709224709225709227709238709249
Patent Drawings (3 sheets)
Description
Field of the Invention
[0002] The present invention relates generally to intrusion detection systems and, more particularly, to a multilayered intrusion detection system and method.
Background of the Invention
[0003] Intrusion Detection was developed to extend security visibility into the network and monitor the activity of users while they are on the network. An Intrusion Detection System/Service (IDS) can augment an end-to-end security solution as a dynamic security component by detecting, responding to, and reporting unauthorized activity from data derived directly from the network.
[0004] Network intrusion detection is a process that can identify and respond to misuse or policy violations on a network. By placing sensing enabled devices at determined points on,the network, network traffic can be monitored and compared against patterns or “signatures” that represent suspicious activity, misuse, or actual attacks. These devices can send alerts to the security management system and, under appropriate circumstances, send commands directly to network equipment such as routers and firewalls, reconfiguring them to deny access to the attacker. The system can automatically and quickly responds in a user-defined manner to send an alert or take immediate action.
[0005] Host-based intrusion detection monitors activity on a single system while network-based intrusion detection monitors all activity over a given network connection or segment. Host-based intrusion detection systems can be used to protect critical network servers or other individual systems containing sensitive information. The implementation of these systems is typically in the form of small clients or applications. Intrusions can be detected by analyzing operating system audit trails, application audit trails, and other system activity.
[0006] Network-based intrusion detection systems can be used to monitor activity on a specific network segment. Where a host-based intrusion detection system resides on a workstation and shares a CPU (central processing unit) with other user applications, a network-based solution is typically a dedicated platform. Conventional network-based intrusion detection systems can perform rule-based or expert system analysis of traffic using parameters set up by the security manager, and the signatures, which flag suspicious or attack activity. The systems can analyze network packet headers to make security decisions based on source, destination, and packet type. They can also analyze packet data to make decisions based on the actual data being transmitted. These systems scale well for network protection because the number of actual workstations, servers or user systems on the network is not critical. It is the amount of traffic which determines performance. In addition, sensing devices placed around the globe can be configured to report back to a central site, enabling a small team of security experts to support a large enterprise.
[0007] There are a variety of technical disadvantages associated with the aforementioned types of Intrusion Detection System/Service (IDS). For example, a host-based IDS cannot detect network wide intrusion attempts. Additionally, host-based systems require the use of a host server's system resources such as disk space, RAM (random access memory), and CPU (central processing unit) time, and, as such, it impacts system performance. Host-based intrusion detection systems are ideal if a limited number of critical servers must be protected, however, they do not scale well if enterprise-wide solutions are needed. Alternatively, a network-based IDS might not have the processing power to detect all intrusion attempts on individual hosts.
[0008] In addition to the technical disadvantages observed by employing the above types of IDS, a series of other technical disadvantages exist in current IDS technology. As network bandwidth continues to increase, IDS's are falling behind. It is possible that even if the IDS identifies an attack in a packet, a receiving host may have accepted the packet before the IDS has had an opportunity to act upon it. Additional technical disadvantages which occur from utilizing a network-based IDS include wasted processing resulting from the network-based IDS processing traffic which the host will discard without using as well as the network-based IDS's inability to process encrypted traffic.
Summary of the Invention
[0009] In accordance with the teachings of the present invention, a multilayered intrusion detection system and method is provided.
[0010] In one aspect, the present invention provides an intrusion detection method which maintains at least one registry indicating at least one host node capable of performing host-based intrusion detection services. The method also includes monitoring activity on a network and comparing at least one characteristic of the monitored activity with at least one host node in the registry. The network activity is dismissed when the monitored activity has at least one characteristic in common with at least one host node in the registry.
[0011] Another aspect of the present invention provides an intrusion detection method which includes monitoring activity on a network and maintains a registry of each host node address associated with a host node operable to perform host-based intrusion detection services. The method includes comparing a destination address of the monitored network activity with at least one host node address in the registry and dismissing the network activity having a destination address in common with at least one host node address in the registry. Intrusion detection services are performed on the network activity not dismissed to a registered host node by any of a plurality of network nodes and on the dismissed network activity using the host-based intrusion detection service operable on the host node receiving the dismissed network activity.
[0012] In yet another aspect, the present invention provides a computer system for use as an intrusion detection system including at least one processor and at least one computer readable medium communicatively coupled to the processor. A registry is stored on the computer readable medium, the registry operable to maintain entries indicative of at least one host node operable to perform intrusion detection services. The computer system is operable to dismiss network activity having a destination address indicative of at least one entry in the registry.
[0013] Another aspect of the present invention provides an intrusion detection system including at least one host node and at least one network node communicatively coupled to the host node including at least one processor and at least one computer readable medium communicatively coupled to the processor. A registry is stored on the computer readable medium, the registry operable to maintain entries indicative of at least one host node operable to perform intrusion detection services. The network node is operable to dismiss network activity having a destination address indicative of at least one host node entry in the registry.
[0014] In yet another aspect, the present invention provides a computer readable medium comprising at least one program operable to maintain at least one registry. The program is also operable to compare at least one characteristic of monitored network activity to at least one characteristic of the registry and to dismiss monitored network activity having at least one characteristic in common with at least one characteristic of the registry.
[0015] One technical advantage provided by the present invention is its ability to reduce the intrusion detection duties performed by network servers or other network appliances by performing intrusion detection duties at appropriately enabled hosts.
[0016] Another technical advantage provided by the present invention is its ability to perform intrusion detection monitoring on encrypted network traffic.
[0017] Yet another technical advantage provided by the present invention lies in its ability to prevent intruders, undetected by network intrusion detection services, from intruding host devices on the network by performing intrusion detection services at each registered host node.
[0018] An additional technical advantage provided by the present invention is its ability to allow a network intrusion detection system to perform primarily network-wide intrusion detection by enlisting hosts to perform host-based intrusion detection services.
[0019] Another technical advantage provided by the present invention is its ability to perform intrusion detection services on networks with more traffic than previously possible by sharing intrusion detection duties amongst network nodes and host nodes.
[0020] Another technical advantage provided by the present invention is its ability to provide comprehensive intrusion detection services on networks using tunneling services such as those utilized in virtual private networks (VPN).
Brief Description of the Drawings
[0021] For a more complete understanding of the present invention, and the advantages thereof, reference is now made to the following written description taken in conjunction with the accompanying drawings, in which:
[0022] FIG. 1 illustrates a block diagram of a network according to an embodiment of the present invention;
[0023] FIG. 2 illustrates a block diagram of a method performed by a network node according to an embodiment of the present invention;
[0024] FIG. 3 illustrates a method performed by a host node according to an embodiment of the present invention;
[0025] FIG. 4 illustrates an embodiment of a network node configuration according to the present invention; and
[0026] FIG. 5 illustrates a network node hierarchy according to the present invention.
Detailed Description of a Preferred Embodiment
[0027] Referring now to FIG. 1, a block diagram of a network according to an embodiment of the present invention is illustrated. As illustrated in FIG. 1, Internet 105 is communicatively coupled to Intranet 110 via two-way communication medium 115. A standard set of components which might be included in Intranet 110 includes network node 120, host node 125 and Intrusion Detection Service (IDS) enabled host node 130. Alternative embodiments of the network configuration illustrated in FIG. 1 might include two or more Intranets communicatively coupled together, as well as the addition of firewalls or other network appliances such as routers in either Intranet 110 or Internet 105. Additionally, network node 120 can be any device, such as a server, having processing power and the ability to transmit and receive network activity. Host node 125 and IDS enabled host node 130, like network node 120, are network components having processing power and network communication capabilities. Host nodes 120 and 130 can be servers or personal computers, as well as network appliances such as routers.
[0028] Referring now to FIG. 2, an illustration of a block diagram of a method performed by a network node according to an embodiment of the present invention is shown. The present invention achieves its many advantages, in part, by maintaining a registry of host nodes capable of performing intrusion detection services. The present invention begins its methodology implemented in network node 120 by monitoring network activity on the network segment to which network node 120 is attached as indicated at step 205. At step 205, network activity is monitored by performing a series of inquiries on the network activity received by network node 120. At step 205, network activity is monitored to determine whether the network activity is a data transmission or if the network activity is registry information intended to update the registry maintained by network node 120. As a result of this determination, the method of FIG. 2 proceeds either to step 210 for registry maintenance or to step 215 for data transmission processing.
[0029] In the situation where it is determined that the network activity is registry information intended to update the registry maintained by network node 120, the network activity or registry information is passed to step 210 for registry maintenance. Upon receipt of the registry information from step 205, maintenance of the registry is performed at step 210. The registry maintained by network node 120 includes entries indicative of host nodes registered as being able to perform intrusion detection services. These entries can include such indicators as the IP (Internet Protocol) address of each registered node, the MAC (media access control) address of each node, the network card address of each node, or any other information which can distinguish one node from another node.
[0030] Routine registry maintenance procedures might include first verifying whether or not the node entry to be updated currently exists or not. For example, if the registry update information is intended to add a node to the registry, a determination whether or not the node entry already existed in the registry would be performed at step 210. At step 210, if an entry exists, the registry update information is compared to the existing entry and the existing entry is updated accordingly. If it was determined that entry for the node to be added did not previously exist, a new entry containing all of the appropriate information indicative of the node to be added would be created.
[0031] In the situation where the registry update information is intended to delete or disable a node from the registry, verification of the existence of an entry indicative of the node is performed at step 210. If an entry is not found, the registry update information can be discarded or other measures can be taken. If an entry for the node to be disabled is found at step 210, the entry would then be disabled or deleted and the registry updated to reflect the node as no longer being able to perform intrusion detection services. Upon completion of the processing associated with the registry update information, an updated registry is made available to network node 120 for the data transmission processing performed at step 215.
[0032] As mentioned above, one possible determination which can be made at step 205 is that the network activity monitored by network node 120 is a data transmission. If this determination is made at step 205, the characteristics of the data transmission are passed on to step 215.
[0033] At step 215, characteristics of the data transmission are compared against the entries in the registry maintained by the network node 120. In order for the network to be protected from potential dangers, measures are taken at step 215 to ensure that the data transmission can be trusted. At step 215, the data transmission is evaluated to determine whether or not the data transmission is destined for a registered host node. This determination can be performed by reading the destination address contained in the packets which make up the network activity or data transmission and comparing that address with the addresses of the host nodes in the registry, as well as by other means. If the data transmission is determined to be destined for a registered host node or host nodes, the method of FIG. 2 proceeds to step 220. At step 220, the data transmission is dismissed and allowed to proceed unencumbered to each registered host node for which it was intended. If it is determined at step 215 that the data transmission is not destined for a registered host node, such as network activity destined for host node 125, the data transmission is halted for processing at step 225.
[0034] At step 225, intrusion detection services are performed on the data transmission. These intrusion detection services can be performed either by host-based intrusion detection services available on the network node 120 or by network-based intrusion detection services available on network node 120. Additionally, the data transmission may be passed by network node 120, to another node, host or network, having the ability to perform intrusion detections services on the data transmission.
[0035] When the network activity is processed at step 225 of FIG. 2, it looks for patterns of misuse. Patterns can be as simple as an attempt to access a specific port on a specific host, or as complex as sequences of operations distributed across multiple hosts over an arbitrary period of time. The first type of pattern is termed an atomic pattern; the second, a composite pattern.
[0036] At step 225, searches for patterns of misuse are performed by examining either the data portion or the header portion of network packets. Content-based attacks derive from the data portion, and context-based attacks derive from the header portion.
[0037] Another methodology for intrusion detection services includes a “three-tier” attack detection capability. Examples include: Named attacks - - - Single attacks that have specific names or common identities, Smurf, PHF, Land, General Category attacks - - - Attacks that keep appearing in new variations with the same basic methodology, Impossible IP Packet, IP fragmentation, Extraordinary attacks - - - Extremely complicated or multi-faceted attacks, TCP hijacking, and E-mail spam.
[0038] Such a detection methodology allows for the detection General Category attacks on-the-fly even as hackers launch new variations in an attempt to fool security systems. For example, there are now many variations of the original named “Land” attack which are all variations of the general category “Impossible IP Packet.” So even as more variations evolve, over time the general category signature will detect them.
[0039] The results of the intrusion detection services performed at step 225 typically come in one of two forms. If no intrusion attempt is detected by the intrusion detection services, the method of FIG. 2 proceeds to step 240. If, at step 225, an attempt at network intrusion is detected, step 235 begins enacting network protection measures. Network protection measures can include sounding an alarm, denying access, creating a log, as well as other measures. Network protection will be discussed in greater detail below.
[0040] Once a data transmission has been allowed to proceed to an intrusion detection service enabled host node at step 220, once data has been determined to be clean by step 225 or once network protection measures have been enacted by step 235, the method of FIG. 2 returns to step 205 to continue network activity monitoring. Additional method steps as well as methods can be included in the processes performed by network node 120 without departing form the spirit and scope of the present invention.
[0041] Referring now to FIG. 3, a method performed by a host node according to an embodiment of the present invention is illustrated. The method of processing performed in an intrusion detection service enabled host node begins at step 305 upon receipt of the data transmission dismissed by network node 120. In order to reduce the overhead at the network nodes 120, host node 130 is enabled to perform intrusion detection services on the network activity it receives. Upon dismissal of network activity by network node 120, intrusion detection services enabled host node 130 performs intrusion detection services on the network activity it receives.
[0042] At step 305, host node 130 performs intrusion detection services, preferably host-based, to determine whether or not the network activity includes a network intrusion attempt. Once the intrusion detection services of host node 130 have been performed, clean activity is passed on to step 310 for processing by the data processing system incorporated into host node 130. Data processing functions might include e-mail capabilities, word processing, and other applications operable on a host node 130. If step 305 determines that the network activity includes a network intrusion attempt, the method of host node 130 proceeds to step 315 to enact network security protection measures. As mentioned above, network security measures can include sounding an alarm, changing the configurations on firewalls and routers, denying access, as well as other measures. Network security measures will be discussed in greater detail below.
[0043] As mentioned above, when network intrusion detection services are performed on network activity, patterns of misuse are searched for. Patterns can be as simple as an attempt to access a specific port on a specific host, or as complex as sequences of operations distributed across multiple hosts over an arbitrary period of time. The first type of pattern is termed an atomic pattern; the second, a composite pattern.
[0044] These searches for patterns of misuse are performed by examining either the data portion or the header portion of network packets are performed. Content-based attacks derive from the data portion, and context-based attacks derive from the header portion.
[0045] Another methodology for intrusion detection services includes a “three-tier” attack detection capability. Examples include: Named attacks - - - Single attacks that have specific names or common identities, Smurf, PHF, Land, General Category attacks - - - Attacks that keep appearing in new variations with the same basic methodology, Impossible IP Packet, IP fragmentation, Extraordinary attacks - - - Extremely complicated or multi-faceted attacks, TCP hijacking, and E-mail spam.
[0046] Such a detection methodology allows for the detection General Category attacks on-the-fly even as hackers launch new variations in an attempt to fool security systems. For example, there are now many variations of the original named “Land” attack which are all variations of the general category “Impossible IP Packet.” So even as more variations evolve, over time the general category signature will detect them.
[0047] Maintained on host node 130 is an agent, configured to perform a variety of functions for host node 130 as indicated at step 320. One function performed by the agent is to register the host node with the registry as being capable of performing intrusion detection services. The agent sends host node 130 information to network node 120 indicating the various information components required by network node 120 to create an entry indicative of host node 130. The agent can also be enabled to perform automated service updates to the host node on which it is maintained. For example, if the intrusion detection service operating on host node 130 needs to be updated to detect new versions of intrusion attempts, step 320 requests and manages the updates for host node 130 without requiring interaction form a host node user. The agent maintained at step 320 can also be configured to update other software applications resident on host node 130, as well as other characteristics of host node 130.
[0048] Activity generated as a result of enacting network protection measures at step 315, data processing activities at step 310 and agent actions at step 320 are placed on the network for transmission to network node 130 as indicated at 325.
[0049] Referring now to FIG. 4, an embodiment of a network node configuration according to the present invention is illustrated. An IDS can be implemented as a real-time intrusion detection system that includes sensors 405, stealthy security appliances that act as “sniffers,” and a director 410, a centralized management console. Director 410 can be configured to collect incoming sensor 405 data, translate it, and present it to security personnel in a map-based and intuitive graphical interface. Users can quickly access additional information about the type of attack from a Director's Network Security Database (NSDB). Director 410 can also be configured to allow security personnel to manage the configuration of remote sensors 405.
[0050] Each sensor 405 is positioned such that each can monitor network activity from host nodes 130 contained on segments of Intranet 110 and Internet 105. As the present invention teaches, when sensor 405 monitors this activity, it is checking to see if the network activity is destined for an intrusion detection enabled host node 130. The registry 420 sensor 405 uses to determine whether the destination address of network activity is indicative of a registered host node 130 can reside on sensor 405, on director 410 or be otherwise accessible by sensor 405. Post office 415 can be utilized by sensor 405 to communicate with an appropriate registry 420.
[0051] As illustrated, it is possible that each network segment monitored has a dedicated sensor 405, including the Internet, Intranet, and Extranet. The sensor 405 appliance of the present invention is optimized for specific data rates and interfaces, such as Ethernet (10BaseT), Fast Ethernet (100BaseT), Token Ring (4 and 16 Mbps), and Fiber Distributed Data Interface (FDDI) (Single or Dual mode) as well as others. Sensors 405 can be configured to use an expert rules-based system engine to distill large volumes of network activity into meaningful security events. In this scenario, it is possible that each sensor 405 have a local registry 420 indicative of host nodes located on each respective network segment to which each sensor 405 is coupled.
[0052] Post Office 415 is a communications architecture configured to provide communications between the sensors 405 and directors 410. Communication is supported by a connectionless-based protocol that can switch between alternate routes to maintain point-to-point connections allowing, at least in part, for at least one copy of a registry 420 to always be accessible.
[0053] The high performance of sensor 405 and the sharing of intrusion detection services with host nodes 130 allows sensor 405 to monitor nearly every packet on a network segment. Therefore, it is not required to create profiles and omit signatures, or create other IDS exceptions which entail constant and extraordinary knowledge of a network to ensure that the correct attack signatures are enabled.
[0054] As mentioned earlier, after an attack is detected network security measures can be generated by sensor 405 which can respond to an attack in the following user-configurable ways: Generate an alarm—alarms are generated by sensor 405, and are typically routed to one or more remote director 410. Log the alarm event—all sensor log data is written to flat files, which are either event logs or IP session logs. Record the session to an IP session log to either gather evidence of an unlawful activity or to record an intruder's knowledge of the network. This capability is commonly used in conjunction with a “fishbowl” or “honeypot” technique where an intruder is vectored into a “safe” network or server that impersonates important applications or information. Other security measures are anticipated by the present invention.
[0055] Referring now to FIG. 5, a network node hierarchy according to the present invention is illustrated. The alternate embodiment of a network node depicted in FIG. 5 illustrates another feature of the director/sensor network node configuration and its ability to build hierarchies of sensor 405 and director 510 and 515 systems through the use of message propagation. Instead of broadcasting events from a sensor onto multiple devices, information can be sent to a single director 510 or 515, which can then propagate packets onto other platforms defined by local configuration files. Likewise, a single registry can be maintained by director 510 and 515 which is accessible, via post office 415, by all sensors 405 coupled to the network. Sensors 405 can propagate messages to more than one director 510 and 515, thereby ensuring fault-tolerant communication.
[0056] FIG. 5 illustrates this concept through a simple hierarchy of directors 510 and 515. In addition to providing performance benefits and fault tolerance of both communications and registry verifications/usage, distribution hierarchies can simplify system management. For example, local director 510 might be responsible for monitoring from 9 A.M. to 5 P.M. and then transfer control onto a central director 515 every evening.
[0057] Although the present invention and its advantages have been described in detail it should be understood that various changes, substitutions, and alterations can be made hereto without departing from the spirit and scope of the invention as defined by the following claims.
Claims
What is claimed is:
1. An intrusion detection method comprising:
maintaining at least one registry indicating at least one host node capable of performing intrusion detection services, the registry operable to distinguish the host node from any other host node;
monitoring activity on a network;
comparing at least one characteristic of the monitored activity with the registry;
determining based on the comparison whether the monitored activity has the characteristic in common with any of the host nodes in the registry; and
dismissing the monitored activity having at least one characteristic in common with at least one host node in the registry.
2. The method of claim 1 further comprising comparing at least one destination address of the monitored activity with the registry of host nodes.
3. The method of claim 1 further comprising maintaining an agent on the host node configured to register the host node in the registry.
4. The method of claim 3 further comprising enabling the agent to update services available to the host node.
5. The method of claim 1 further comprising performing intrusion detection services on the dismissed monitored activity received by a host node.
6. The method of claim 1 further comprising performing intrusion detection services on monitored activity not dismissed.
7. The method of claim 6 wherein the intrusion detection services are performed by a network intrusion detection system.
8. The method of claim 1 further comprising monitoring network activity on a tunneling network.
9. An intrusion detection method comprising:
monitoring activity on a network;
maintaining a registry of each host node address associated with a host node operable to perform host-based intrusion detection services, the each host node address operable to distinguish the host node from another host node;
comparing a destination address of the network activity with at least one host node address in the registry;
determining based on the comparison whether the monitored activity has the destination address in common with any of the host node addresses;
dismissing the network activity having a destination address in common with at least one host node address in the registry to the host node;
performing intrusion detection services on the network activity not dismissed to a registered host node; and
performing intrusion detection services on the dismissed network activity using the host-based intrusion detection service operable on the host node receiving the dismissed network activity.
10. The method of claim 9 further comprising maintaining at least one agent, by each host node indicated in the registry, operable to perform host node registration.
11. The method of claim 10 further comprising enabling the agent to update characteristics associated with the host node.
12. The method of claim 9 further comprising performing network-based intrusion detection services on the network activity not dismissed to a registered host node.
13. A computer system for use as an intrusion detection system comprising:
at least one processor;
at least one computer readable medium communicatively coupled to the processor;
a registry stored on the computer readable medium, the registry operable to maintain entries indicative of at least one host node operable to perform intrusion detection services, the registry further operable to distinguish the host node from another host node; and wherein
the computer system is operable to compare a characteristic of network activity to the registry, to determine whether the network activity has the characteristic in common with any of the host nodes in the registry based on the comparison, and to dismiss network activity having a destination address indicative of at least one entry in the registry.
14. The system of claim 13 further comprising:
at least one host node communicatively coupled to the computer system including at least one processor; at least one computer readable medium communicatively coupled to the processor; at least one agent stored on the computer readable medium, operable to register the host node with the registry; and wherein the at least one host node is operable to perform intrusion detection services.
15. The system of claim 14 wherein the at least one agent is further operable to update services available to the host node.
16. The system of claim 13 wherein the computer system is further operable to monitor network activity.
17. The system of claim 13 wherein the computer system is further operable to compare a destination address of the network activity with at least one entry in the registry.
18. The system of claim 13 wherein the computer system is further operable to perform network-based intrusion detection services.
19. The system of claim 13 wherein the computer system is further includes: at least one sensor; and at least one director.
20. The system of claim 19 wherein the computer system further includes at least one post office operable to enable communication between at least the sensor and the director.
21. An intrusion detection system comprising:
at least one host node;
at least one network node communicatively coupled to the host node including at least one processor;
at least one computer readable medium communicatively coupled to the processor;
a registry stored on the computer readable medium, the registry operable to maintain entries indicative of at least one host node operable to perform intrusion detection services, the registry further operable to distinguish the host node from another host node; and wherein
the network node is operable to compare a destination address of network activity to the registry, to determine whether the network activity has the destination address in common with any of the entries in the registry based on the comparison, and to dismiss network activity having a destination address indicative of at least one entry in the registry.
22. An apparatus comprising:
a computer readable medium comprising at least one program operable, when executed on a processor, to:
maintain at least one registry indicating at least one host node capable of performing intrusion detection services, the registry operable to distinguish the host node from any other host node;
compare at least one characteristic of monitored network activity to at least one characteristic of the registry;
determine based on the comparison whether the monitored activity has the characteristic in common with any of the host nodes in the registry; and
dismiss monitored network activity having at least one characteristic in common with at least one characteristic of the registry.
23. A computer system for use as an intrusion detection system comprising:
a means for processing data;
a means for storing data, the means for storing data communicatively coupled to the means for processing data;
a means for maintaining entries indicative of at least one host node operable to perform intrusion detection services, the means for maintaining entries stored in the means for storing data, the entries operable to distinguish the host node from any other host node;
a means for determining based on the comparison whether the monitored activity has the characteristic in common with any of the host nodes in the registry; and
a means for dismissing network activity having a destination address indicative of at least one entry in the means for maintaining entries.
Patent Citations (47)
| Patent | Date | Inventor | Cited By |
|---|---|---|---|
| US5032979(A) | 1991-07-01 | Hecht et al. | Applicant |
| US5101402(A) | 1992-03-01 | Chiu et al. | Applicant |
| US5278901(A) | 1994-01-01 | Shieh et al. | Applicant |
| US5414833(A) | 1995-05-01 | Hershey et al. | Applicant |
| US5448724(A) | 1995-09-01 | Hayashi | Applicant |
| US5488715(A) | 1996-01-01 | Wainwright | Applicant |
| US5524238(A) | 1996-06-01 | Miller et al. | Applicant |
| US5557742(A) | 1996-09-01 | Smaha et al. | Applicant |
| US5606668(A) | 1997-02-01 | Shwed | Applicant |
| US5621889(A) | 1997-04-01 | Lermuzeaux et al. | Applicant |
| US5699513(A) | 1997-12-01 | Feigen et al. | Applicant |
| US5793763(A) | 1998-08-01 | Mayes et al. | Applicant |
| US5796942(A) | 1998-08-01 | Esbensen | Applicant |
| US5798706(A) | 1998-08-01 | Kraemer et al. | Applicant |
| US5805801(A) | 1998-09-01 | Holloway et al. | Applicant |
| US5826014(A) | 1998-10-01 | Coley et al. | Applicant |
| US5905859(A) | 1999-05-01 | Holloway et al. | Examiner |
| US5919257(A) | 1999-07-01 | Trostle | Applicant |
| US5931946(A) | 1999-08-01 | Terada et al. | Applicant |
| US5991881(A) | 1999-11-01 | Conklin et al. | Examiner |
| US6067585(A) | 2000-05-01 | Hoang | Examiner |
| US6131120(A) | 2000-10-01 | Reid | Examiner |
| US6144739(A) | 2000-11-01 | Witt et al. | Examiner |
| US6167403(A) | 2000-12-01 | Whitmire et al. | Examiner |
| US6243756(B1) | 2001-06-01 | Whitmire et al. | Examiner |
| US6292098(B1) | 2001-09-01 | Ebata et al. | Examiner |
| US6298445(B1) | 2001-10-01 | Shostack et al. | Examiner |
| US6304973(B1) | 2001-10-01 | Williams | Examiner |
| US6314409(B2) | 2001-11-01 | Schneck et al. | Examiner |
| US6321337(B1) | 2001-11-01 | Reshef et al. | Examiner |
| US6321338(B1) | 2001-11-01 | Porras et al. | Examiner |
| US6324656(B1) | 2001-11-01 | Gleichauf et al. | Examiner |
| US6347374(B1) | 2002-02-01 | Drake et al. | Examiner |
| US6385724(B1) | 2002-05-01 | Beckman et al. | Examiner |
| US6405318(B1) | 2002-06-01 | Rowland | Examiner |
| US6484203(B1) | 2002-11-01 | Porras et al. | Examiner |
| US6487665(B1) | 2002-11-01 | Andrews et al. | Examiner |
| US6507908(B1) | 2003-01-01 | Caronni | Examiner |
| US6542993(B1) | 2003-04-01 | Erfani | Examiner |
| US6574736(B1) | 2003-06-01 | Andrews | Examiner |
| US6574737(B1) | 2003-06-01 | Kingsford et al. | Examiner |
| US6578147(B1) | 2003-06-01 | Shanklin et al. | Examiner |
| US6584508(B1) | 2003-06-01 | Epstein et al. | Examiner |
| US6584565(B1) | 2003-06-01 | Zamek | Examiner |
| US6597957(B1) | 2003-07-01 | Beakley | Examiner |
| US6611869(B1) | 2003-08-01 | Eschelbeck et al. | Examiner |
| US6678734(B1) | 2004-01-01 | Haatainen et al. | Examiner |
Non-Patent Literature (143)
- Lane et al.; “Temporal Sequence Learning and Data Reduction for Anomaly Detection”. ACM Transactions on Information and System Security, Aug. 1999, vol. 2, No. 3, pp. 295-331.Applicant
- Crosbie et al.; “Defending a Computer System Using Autonomous Agents”. Technical Report No. 95-022, Mar. 1994. Retrieved from the Internet on Apr. 2002, from CORA: Computer Science Research Paper Search Engine.Applicant
- Crosbie et al.; “Active Defence of a Computer System Using Autonomous Agents”. Technical Report No. 95-008, Feb. 1995. Retrieved from the Internet on Apr. 2002, from CORA: Computer Research Paper Search Engine.Applicant
- Helmer et al.; “Intelligent Agents for Intrusion Detection”. IEEE Information Technology Conference, Sep. 1998, pp. 121-124.Applicant
- Balasubramaniyan et al.; “An Architecture for Intrusion Detection Using Autonomous Agents”. Proceedings of the 14th Annual Computer Security Applications Conference, Dec. 1998, pp. 13-24.Applicant
- Maloof et al.; “A Method for Partial-Memory Incremental Learning and its Application to Computer Intrusion Detection”. Proceedings of the 7th International Conference on Tools with Artificial Intelligence, Nov. 1995, pp. 392-397.Applicant
- Barrus et al.; “A Distributed Autonomous-Agent Network-Intrusion Detection and Response System”. NEC Research Index, Procedings of the 1998 Command and Control Research and Technology Symposium, Jun. 1998.Applicant
- Internet Security Systems; “Network vs. Host—Based Intrusion Detection; A Guide to Intrusion Detection Technology”. Internet Security Systems whitepaper, Oct. 1998. Retrieved online on May 2002. Obtained from the Internet: www.iss.net/support/documentation.Applicant
- Neumann et al.; “Experience with EMERALD to DATE”. 1st USENIX Workshop on Intrusion Detection and Network Monitoring, Apr. 1999, pp. 73-80.Applicant
- Ilgun et al.; “State Transition Analysis: A Rule-Based Intrusion Detection Approach”. IEEE Transactions on Software Engineering, Mar. 1995, vol. 21, No. 3.Applicant
- Sekar et al.; “A High-Performance Network Intrusion Detection System”. Proceedings of the 6th ACM Conference on Computer and Communications Security, Aug. 1999, pp. 8-17.Applicant
- Yau et al., Computer Network Intrusion Detection, Assessment and Prevention Based on Security Dependency Relation, Proceedings of the 23rd International Computer Software and Applications Conference, Oct. 1999, pp. 86-91.Applicant
- Snapp et al., A System for Distributed Intrusion Detection, Digest of Papers, Compcon Spring '91, Mar. 1991, pp. 170-176.Applicant
- White et al., Problems with DCE Security Services, ACM SIGCOMM Computer Communication Review, Oct. 1995, p. 12.Applicant
- Lane et al., Temporal Sequence Learning and Data Reduction for Anomaly Detection, ACM Transactions on Information and System Security, Aug. 1999, vol. 2, No. 3, pp. 295-331.Applicant
- Lee et al., Data Mining Approaches for Intrusion Detection, Proceedings of the 7th USENIX Security Symposium, Jan. 1999.Applicant
- Network Computing, Intrusion Detection, Take Two, Nov. 1999, Retrieved from the Internet: http://www.nwc.com/1023/1023fl.html?Is=NCJS10.Applicant
- Internet Security Systems, Windows NT 4.0 Security Configuration: Locking Down a Windows NT Host for Intrusion Detection, Aug. 1998, Retrieved from the Internet: http://www.iss.net.Applicant
- ICSA Intrusion Detection Systems Consortium, An Introduction to Intrusion Detection and Assessment, Spring 1999, Retrieved from the Internet: http://www.icsalabs.com/html/communities/ids/whitepaper.Applicant
- Stillerman et al., “Intrusion Detection for Distributed Applications”, Communications of the ACM, Jul. 1999, vol. 42, No. 7, pp. 62-69.Applicant
- Durst et al., “Testing and Evaluating Computer Intrusion Detection Systems”, Communications of the ACM, Jul. 1999, vol. 42, No. 7, pp. 53-61.Applicant
- Bonifacio, Jr., et al., “Neural Networks in Intrusion Detection Systems”, The 1998 IEEE International Joint Conference on Neural Networks, vol. 1, May 1998, pp. 205-210.Applicant
- Maloof et al., “A Method for Partial-Memory Incremental Learning and Its Application to Computer Intrusion Detection”, Proceedings of the 7th International Conference on Tools and Al, Nov. 1995, pp. 392-397.Applicant
- Bace et al., “Intrusion Detection Systems”, Macmillan Technical Publishing, 2000.Applicant
- Moghe et al., “RAP-Rate Adaptive Polling for Network Management Applications”, IEEE Network Operations and Management Symposium, Feb. 1998, vol. 2, pp. 395-399.Applicant
- Balasubramaniyan et al., “An Architecture for Intrusion Detection Using Autonomous Agents”, Proceedings of the 14th Annual Computer Security Applications Conference, Dec. 1998, pp. 13-24.Applicant
- Kim et al., “Study of Security Management System Based on Client/Server Model”, 1999 IEEE International Conference on Communications, Jun. 1999, vol. 2, pp. 1403-1408.Applicant
- “Preliminary Report on Advanced Security Audit Trail Analysis on UNIX,” N. Habra et al., pp. 1-34 (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), Sep. 1994.Applicant
- “IDIOT-Users Guide,” M. Crosbie, et al., pp. 1-63, (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), Sep. 1996.Applicant
- “An Introduction to Intrusion Detection,” A. Sundaram, pp. 1-10, (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), 1996.Applicant
- “Use of A Taxonomy of Security Faults,” T. Aslam, et al., pp. 1-10, (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), Sep. 1996.Applicant
- “Artificial Intelligence and Intrusion Detection: Current and Future Directions,” Jeremy Frank, pp. 1-12, (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), Jun. 1994.Applicant
- “ASAX Conceptual Overview,” ASAX Brochure, A. Mounji, (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), Dec. 21, 1999.Applicant
- “GrIDS-A Graph Based Intrusion Detection System For Large Networks,” S. Staniford-Chen, et al., 10 pages, (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), Dec. 21, 1999.Applicant
- “A Pattern Matching Model For Misuse Intrusion Detection,” S. Kumar, et al., pp. 1-11, (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), Jun. 1994.Applicant
- “An Application of Pattern Matching in Intrusion Detection”, S. Kumar, et al., pp. 1-55, (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), Jun. 1994.Applicant
- “A Software Architecture to Support Misuse Intrusion Detection”, S. Kumar, et al., pp. 1-17, (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), Mar. 1995.Applicant
- “Applying Genetic Programming to Intrusion Detection”, M. Crosbie, et al., pp. 1-8, (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), Dec. 21, 1999.Applicant
- “Defending a Computer System Using Autonomous Agents”, M. Crosbie, et al., pp. 1-11, (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), Mar. 1994.Applicant
- “Analysis Of An Algorithm For Distributed Recognition And Accountability”, C. Ko, et al., pp. 1-11, (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), Dec. 21, 1999.Applicant
- “A Standard Audit Trail Format”, Matt Bishop, Proc. of the 1995 NISSC, Baltimore, MD., (found at http://seclab.cs.ucdavis.edu/papers.html), 1995.Applicant
- Master Thesis entitled USTAT A Real-time Intrusion Detection System for UNIX, University of California, K. Ilgun, pp. 1-204, (found at http://www.cs.purdue.edu/coast/archive/data/categ24.html), Nov. 1992.Applicant
- “A Weakness in the 4.2BSD Unix TCP/IP Software”, R. Morris, 4 pages, (found at http://www.cs.purdue.edu/coast/archive/data/categ30.htm.), Feb. 1985.Applicant
- “The Architecture and Implementation of Network-Layer Security Under Unix”, J. Ionnidis, et al., 11 pages, (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), Dec. 21, 1999.Applicant
- “A Best-Case Network Performance Model”, S.M. Bellovin, pp. 1-10, (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), Feb. 1992.Applicant
- “OARnet Security Procedures”, K. Varadhan, pp. 1-14, (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), Sep. 1992.Applicant
- “Paving The Road To Network Security Or The Value Of Small Cobblestones”, H. Orman, et al., pp. 1-17, (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), May 1994.Applicant
- “Packets Found on an Internet”, S. Bellovin, pp. 1-6, (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), Aug. 1993.Applicant
- “Security Problems in the TCP/IP Protocol Suite”, S.M. Bellovin, (reprinted from Computer Communication Review, vol. 19, No. 2, pp. 32-48) pp. 1-17, Apr. 1989.Applicant
- “A Security Analysis of the NTP Protocol”, Matt Bishop, pp. 1-20, (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), 1990.Applicant
- “WAN-hacking with AutoHack-Auditing Security Behind the Firewall”, Alec Muffett, 14 pages, (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), Jun. 1995.Applicant
- “ACMAINT: An Account Creation and Maintenance System for Distributed UNIX Systems”, D.A. Curry, et al., pp. 1-9, (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), Oct. 1990.Applicant
- “NFS Tracing By Passive Network Monitoring”, Matt Blaze, 11 pages, (found at http://www.cs.purdue/edu/coast/archive/data/categ30.html), Dec. 21, 1999.Applicant
- “Pseudo-Network Drivers and Virtual Networks”, S.M. Bellovin, 15 pages, (found at http://www.cs.purdue/edu/coast/archive/data/categ30.html), Dec. 21, 1999.Applicant
- Masters Thesis entitled “Addressing Weaknesses In The Domain Name System Protocol”, Purdue University, Christoph Schuba, pp. 1-87., (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), Aug. 1993.Applicant
- “Countering Abuse of Name-Based Authentication”, C.L. Schuba, et al., pp. 1-21., (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), Dec. 21, 1999.Applicant
- “The ‘Session Tty’ Manager”, S.M. Bellovin, pp. 1-16., (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), Dec. 21, 1999.Applicant
- “Secure RPC Authentication (SRA) for TELNET and FTP”, D.R. Safford, et al., pp. 1-5, (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), 1993.Applicant
- “A Reliable and Secure UNIX Connection Service”, D. Draheim, et al., pp. 1-12, (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), Dec. 21, 1999.Applicant
- “TCP Wrapper Network Monitoring, Access Control, and Booby Traps”, Wietse Venema, 8 pages., (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), Dec. 21, 1999.Applicant
- “Characteristics of Wide-Area TCP/IP Conversations”, R. Cáceres, et al., pp. 1-12, (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), 1991.Applicant
- “A Unix Network Protocol Security Study: Network Information Service”, D.K. Hess, et al., 5 pages, (found at http://www.cs.pudue.edu/coast/archive/data/categ30.html), Dec. 21, 1999.Applicant
- “Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection”, T.H. Ptacek et al., pp. 1-63, Jan. 1998.Applicant
- “A Method to Detect Intrusive Activity in a Networked Environment”, L.T. Heberlein et al., Proc. of the 14th National Computer Security Conference, Oct. 1991, pp. 362-371., (found at http://seclab.cs.ucdavis.edu/papers.html.), 1991.Applicant
- “Internetwork Security Monitor: An Intrusion-Detection System for Large-Scale Networks”, L.T. Heberlein et al., Proc. of the 15th National Computer Security Conference, Oct. 1992, pp. 262-271, 1992.Applicant
- “Comparison Between Internet Security Scanner (ISS) 1.x and Internet Scanner 3.2”, by Internet Security Systems., (found at http://www.iss.net), 1996.Applicant
- “Automated Tools for Testing Computer System Vulnerability”, W.T. Polk, 40 pages, Dec. 1992.Applicant
- The Design of GrIDS: A Graph-Based Intrusion Detection System, S. Cheung et al., U.C. Davis Computer Science Department Technical Report SCE-99-2, 1999, pp. 1-47, (found at http://seclab.cs.ucdavis.edu/papers.html.), Jan. 26, 1999.Applicant
- “Luby-Rackoff Backwards: Increasing Security of Making Block Ciphers Non-Invertible”, M. Bellare, et al., Advances in Cryptology-Eurocrypt 98 Proceedings, Lecture Notes in Computer Science, vol. 1403 Springer-Verlat (1998) pp. 1-27, (found at http://seclab.cs.ucdavis.edu/papers.html.), Oct. 17, 1998.Applicant
- “Detecting Disruptive Routers: A Distributed Network Monitoring Approach”, K.A. Bradley, et al, Proceedings of the 1998 IEEE Symposium on Security and Privacy, Oakland, CA, pp. 115-124 (found at http://seclab.cs.ucdavis.edu/papers.html.), May 1998.Applicant
- “Stack and Queue Integrity on Hostile Platforms”, P.T. Devanbu, et al., IEEE Symposium on Security and Privacy, Oakland CA, (found at http://seclab.cs.ucdavis.edu/papers.html.), 1998.Applicant
- “Techniques for Trusted Software Engineering”, P.T. Devanbu et al., Proceedings of the 20th International Conference on Software Engineering, Kyoto, Japan, (found at http://seclab.cs.ucdavis.edu/papers.html.), 1998.Applicant
- “Data Level Inference Detection in Database Systems”, R.W. Yip et al., Proceedings of the 11th IEEE Computer Security Foundations Workshop, Rockport, Massachusetts,(found at http://seclab.cs.ucdavis.edu/papers.html.), 1998.Applicant
- “The Design and Implementation of a Data Level Database Inference Detection System”, Yip et al., Proceedings of the Twelfth Annual IFIP WG 11.3 Working conference on Database Security, Chalkidki, Greece 14 pages, (found at http://seclab.cs.ucdavis.edu/papers.html.), 1998.Applicant
- “Theft of Information in the Take-Grant Protection Model”, Matt Bishop, 35 pages, Journal of Computer Security 4(4)(1996), (found at http://seclab.cs.ucdavis.edu/papers.html.) Mar. 13, 1997.Applicant
- “Information Survivability, Security, and Fault Tolerance”, Matt Bishop, position paper for the Information Survivability Workshop Journal of Computer Security #6) 1 page, (found at http://seclab.cs.ucdavis.edu/papers.html), 1997.Applicant
- “Teaching Computer Security”, Matt Bishop, position paper for the Workshop on Education in Computer Security, Monterey CA, 3 pages, (found at http://seclab.cs.ucdavis.edu/papers.html.), 1997.Applicant
- “Protecting Routing Infrastructures from Denial of Service Using Cooperative Intrusion Detection”, S. Cheung et al., Proc. new Security Paradigms Workshop, Cumbria, UK 13 pages, (found at http://seclab.cs.ucdavis.edu/papers.html.), 1997.Applicant
- “An Efficient Message Authentication Scheme for Link State Routing”, S. Cheung, Proc. 13th annual Computer Security Applications Conference, San Diego, CA, 9 pages, (found at http://seclab.cs.ucdavis.edu/papers.html.), 1997.Applicant
- “Cryptographic Verification of Test Coverage Claims”, P. Devanbu et al., Proceedings, Fifth ACM/SIGSOFT Conference on Foundations of Software Engineering , Zurich, Switzerland) (found at http://seclab.cs.ucdavis.edu/papers.html.), 1997.Applicant
- “Property-Based Testing; A New Approach to Testing for Assurance”, Fink et al., ACM SIGSOFT Software Engineering Notes, 22(4), (found at http://seclab.cs.ucdavis.edu/papers.html.), 1997.Applicant
- “Checking for Race Conditions in File Accesses”, Bishop et al., Computing Systems 9(2)., (found at http://seclab.cs.ucdavis.edu/papers.html.), 1996.Applicant
- “An Isolated Network for Research”, Bishop et al., The 19th NISSC, pp. 1-9, (found at http://seclab.cs.ucdavis.edu/papers.html.), 1996.Applicant
- “Goal-Oriented Auditing and Logging”, Bishop et al., submitted to IEEE Transactions on Computing Systems, (found at http://seclab.cs.ucdavis.edu/papers.html.), 1996.Applicant
- “Extending The Take-Grant Protection System”, J. Frank et al., The IEEE Oakland Conference on Research in Security and Privacy., (found at http://seclab.cs.ucdavis.edu/papers.html.), Dec. 5, 1996.Applicant
- Network Security Via Reverse Engineering of TCP Code: Vulnerability Analysis and Proposed Solutions, Guha et al., Proc. of the IEEE Infocom '96, San Francisco, CA (found at http://seclab.cs.ucdavis.edu/papers.html), 1996.Applicant
- “Attack Class: Address Spoofing”, Heberlein et al., The 19th National Information Systems Security Conference, (found at http://seclab.cs.ucdavis.edu/papers.html), 1996.Applicant
- PhD. Theses entitled Execution Monitoring Of Security-Critical Programs In A Distributed System: A Specification-Based Approach, Calvin Cheuk Wang Ko, 111 pages, (found at http://seclab.cs.ucdavis.edu/papers.html), 1996.Applicant
- “A Methodology for Testing Intrusion Detection Systems”, Puketza et al., IEEE Transactions on Software Engineering, vol. 22, No. 10, (found at http://seclab.cs.ucdavis.edu/papers.html), 1996.Applicant
- “The Exact Security of Digital Signatures-How to Sign with RSA and Rabin”, Bellare et al. Earlier version appears in Advances in Crytology—Eurocrypt '96, LNCS vol. 1070, U. Maurer ed., Springer-Verlag, pp. 399-416), (found at http://seclab.cs.ucdavis.edu/papers.html), 1996.Applicant
- “How to Protect DES Against Exhaustive Key Search”, Kilian et al., Advances in Cryptology—CRYPTO'96., (found at http://seclab.cs.ucdavis.edu/papers.html), 1996.Applicant
- “GrIDS-A Graph Based Intrusion Detection System For Large Networks”, Staniford-Chen et al., The 19th NISSC. 10 pages, (found at http://seclab.cs.ucdavis.edu/papers.html), 1996.Applicant
- “NetKuang-A Multi-Host Configuration Vulnerability Checker”, Zerkle et al., Proc. of the 6th USENIX Security Symposium, San Jose, CA., (found at http://seclab.cs.ucdavis.edu/papers.html), 1996.Applicant
- Abstract entitled Theft of Information in the Take-Grant Protection Model, Matt Bishop, Journal of Computer Security, vol. 3, No. 4, (found at http://seclab.cs.ucdavis.edu/papers.html), 1995.Applicant
- “Improving System Security via Proactive Password Checking”, Matt Bishop,Computers & Security, vol. 14, No. 3, pp. 233-249, (found at http://seclab.cs.ucdavis.edu/papers.html), 1995.Applicant
- “Simulating Concurrent Intrusions for Testing Intrusion Detection Systems: Parallelizing Intrustions”, Chung et al., Proc. of the 1995 NISSC, Baltimore, MD, 11 pages, (found at http://seclab.cs.ucdavis.edu/papers.html), 1995.Applicant
- “Network Security Monitor”, L. Todd Heberlein , Lawrence Livermore National Laboratory project deliverable, (found at http://seclab.cs.ucdavis.edu/papers.html), 1995.Applicant
- “Audit Log Analysis Using the Visual Audit Browser Toolkit”, Hoagland et al., U.C. Davis Computer Science Department Technical Report CSE-95-11, (found at http://seclab.cs.ucdavis.edu/papers.html), 1995.Applicant
- “MCF: A Malicious Code Filter”, R.W. Lo et al., Computers & Security, (1995) vol. 14, No. 6. (27 pages.), (found at http://seclab.cs.ucdavis.edu/papers.html), 1995.Applicant
- “Bucket Hashing and its Application to Fast Message Authentication”, Phillip Rogaway, Acvances in Cryptology—CRYPTO '95, (found at http://seclab.cs.ucdavis.edu/papers.html), 1995.Applicant
- “Provably Secure Session Key Distribution-The Three Party Case”, Bellare et al., Proc. of the 27th Annual ACM Symposium on Theory of Computing, Las Vegas, NV, (found at http://seclab.cs.ucdavis.edu/papers.html), 1995.Applicant
- “XOR MACs: New Methods for Message Authentication Using Finite Pseudorandom Functions”, Bellare et al.,Advances in Cryptology—CRYPTO '95, (found at http://seclab.cs.ucdavis.edu/papers.html), Oct. 1995.Applicant
- “Holding Intruders Accountable on the Internet”, Staniford-Chen et al., Proc. of the 1995 IEEE Symposium on Security and Privacy, Oakland, CA, (11 pages) (found at http://seclab.cs.ucdavis.edu/papers.html), 1995.Applicant
- “LAFS: A Logging and Auditing File System”, Christopher Wee, Proc. of the 11th Computer Security Applications Conference, 10 pages, (found at http://seclab.cs.ucdavis.edu/papers.html), 1995.Applicant
- “Towards a Property-based Testing Environment with Applications to Security-Critical Software”, Fink et al., Proc. of the 4th irvine Software Symposium. 10 pages, (found at http://seclab.cs.ucdavis.edu/papers.html), 1994.Applicant
- “Property-based Testing of Privileged Programs”, Fink et al., Proc. of the 10th Annual Computer Security Applications Conference, Orlando, FL. 10 pages, (found at http://seclab.cs.ucdavis.edu/papers.html), Dec. 1994.Applicant
- “Artificial Intelligence and Intrusion Detection: Current and Future Directions”, Jeremy Frank, Proc. of the 17th National Computer Security Conference. 12 pages, (found at http://seclab.cs.ucdavis.edu/papers.html).Applicant
- “Automated Detection of Vulnerabilities in Privileged Programs by Execution Monitoring”, Ko et al., Proc. of the 10th Annual Computer Security Applications Conference, Orlando, FL. (found at http://seclab.cs.ucdavis.edu/papers.html), 1994.Applicant
- “Common Techniques in Fault-Tolerance and Security”, Levitt et al., Proc. of the Dependable Computing for Critical Applications 4, San Diego, CA. 4 pages, (found at http://seclab.cs.updavis.edu/papers.html), 1994.Applicant
- “Network Intrusion Detection”, Mukherjee et al., IEEE Network, May-June 1994, vol. 8, No. 3, pp. 26-41. (found at http://seclab.cs.ucdavis.edu/papers.html), 1994.Applicant
- “A New Suggestion for How to Encrypt with RSA”, Bellare et al., Eurocrypt '94, 20 pages, (found at http://seclab.cs.ucdavis.edu/papers.html), 1994.Applicant
- “The Security of Cipher Block Chaining”, Bellare et al., Advances in Cryptology—CRYPTO '94, Santa Barbara CA. (19 pages.) (found at http://seclab.cs.ucdavis.edu/papers.html), 1994.Applicant
- “Analysis Of An Algorithm For Distributed Recognition And Accountability”, Ko et al., Proc. 1st ACM Conference on Computer and Communication Security. Fairfax, VA, Nov. 1993, 11 pages, (found at http://seclab.cs.ucdavis.edu/papers.html), 1993.Applicant
- “Entity Authentication and Key Distribution”. Bellare et al., Advances in Cryptology—Crypto '93, Santa Barbara, CA, Aug. 1993, pp. 232-249. (found at http://seclab.cs.ucdavis.edu/papers.html), Aug. 1993.Applicant
- “Random Oracles are Practical: A Paradigm for Designing Efficient Protocols”, Bellare et al., Proc. of the 1st ACM Conference on Computer and Communication Security, Fairfax, VA, Nov. 1993, pp. 1545-164. (found at http://seclab.cs.ucdavis.edu/papers.html), 1993.Applicant
- “A Software-Optimized Encryption Algorithm”, Rogaway et al., Proc. of the Fast Software Encryption Cambridge Security Workshop, Cambridge, UK (16 pages.) (found at http://seclab.cs.ucdavis.edu/papers.html), 1993.Applicant
- “Anatomy of a Proactive Password Changer”, Matt Bishop, Proc. of the UNIX Security Symposium III Baltimore, MD, 15 pages. (found at http://seclab.cs.ucdavis.edu/papers.html), 1992.Applicant
- DIDS (Distributed Intrusion Detection System)- Motivation, Architecture, and An Early Prototype, Snapp et al., Proc. 14th National Computer Security Conference, Washington, DC (9 pages.) (found at http://seclab.cs.ucdavis.edu/papers.html), 1991.Applicant
- “Proactive Password Checking”, Matt Bishop, Proc. of the 7th International Conference on Information Security, May 1991, pp. 169-181. (found at http://seclab.cs.ucdavis.edu/papers.html), 1991.Applicant
- Dissertation entitled Issue in Debugging Sequential and Concurrent Programs: Methods, Techniques, and Implementation, University of California, Wingshun Wilson Ho, 191 pages. (found at http://seclab.cs.ucdavis.edu/papers.html), 1992.Applicant
- Abstract entitled “Collaboration Using Roles” by M. Bishop, Software—Practice and Experience, vol. 20, No. 5, May 1990. (found at http://seclab.cs.ucdavis.edu/papers.html), May 1990.Applicant
- Abstract entitled “An Extendable Password Checker” by M. Bishop, Proc. UNIX Security II Portland, OR, Aug. 27-28 1990, pp. 15-16, (found at http://seclab.cs.ucdavis.edu/papers.html), 1990.Applicant
- Abstract entitled “A Security Analysis of the NTP Protocol Version 2” by M. Bishop, Dec. 1990.Applicant
- Abstract entitled “A Little Knowledge Goes a Long Way: Faster Detection of Compromised Data in 2-D Tables” by D. Gusfield, Proc. of the 1990 IEEE Symposium on Research in Security and Privacy, Oalkland, CA. May 7-9, 1990, pp. 86-94, (found at http://seclab.cs.ucdavis.edu/papers.html), May 1990.Applicant
- Abstract entitled “A Network Security Monitor” by L.T. Heberlein, G.V. Dias, K.N. Levitt, B. Mukherjee, and others, Proc. of the 1990 IEEE Symposium on Research in Security and Privacy, Oakland, CA, May 7-9, 1990, pp. 296-304, (found at http://seclab.cs.ucdavis.edu/papers.html), May 1990.Applicant
- Abstract entitled “Static Analysis Virus Detection Tools for UNIX Systems” by P. Kerchen, et al., Proc. 13th National Computer Security Conference, Washington, DC, Oct. 1-4, 1990, pp. 350-365, (found at http://seclab.cs.ucdavis.edu/papers.html), Oct. 1994.Applicant
- Abstract entitled “Security with Low Communication Overhead” by D. Beaver, et al., Proc. Advances in Cryptology-CRYPTO '90, Santa Barbara, CA, Aug. 11-15, 1990, pp. 62-76, (found at http://seclab.cs.ucdavis.edu/papers.html), Aug. 1990.Applicant
- Abstract entitled “The Round Complexity of Secure Protocols” by D. Beaver, et al., Proc. of the 22nd Annual ACM Symposium on Theory of Computing, Baltimore, MD, May 14-16, 1990, pp. 503-513. (found at http://seclab.cs.ucdavis.edu/papers.html), May 1990.Applicant
- Abstract entitled “PACLs: An Access Control List Approach to Anti-Viral Security” by D.R. Wichers, et al., Proc. 13th National Computer Security Conference, Washington, DC, Oct. 1-4, 1990, pp. 340-349. (found at http://seclab.cs.ucdavis.edu/papers.html), Oct. 1990.Applicant
- Abstract entitled “Verification of Secure Distributed Systems in Higher Order Logic: A Modular Approach Using Generic Components” by J. Alves-Foss, K. Levitt, Proc. of the 1991 IEEE Computer Society Symposium on Research in Security and Privacy, Oakland CA May 20-22, 1991, pp. 122-135. (found at http://seclab.cs.ucdavis.edu/papers.html), May 1991.Applicant
- Abstract entitled “An Authentication Mechanism for USENET” by M. Bishop, Proc. of the Winter 1991 USENIX Conference. Jan. 21-25, 1991, pp. 281-287, (found at http://seclab.cs.ucdavis.edu/papers.html), Jan. 1991.Applicant
- Abstract entitled “Password Management” by M. Bishop, Compcon Spring '91. Digest of Papers. San Francisco, CA, Feb. 25-Mar. 1, 1991, pp. 167-169. (found at http://seclab.cs.ucdavis.edu/papers.html), Mar. 1991.Applicant
- Abstract entitled “Teaching Computer Security” by M. Bishop, May 1993.Applicant
- Abstract entitled “Recent Changes to Privacy Enhanced Election Mail” by M. Bishop, Journal of Internetworking: Research and Experience. vol. 4, No. 1, Mar. 1993, pp. 47-59. (found at http://seclab.cs.ucdavis.edu/papers.html), Mar. 1993.Applicant
- Abstract entitled “A Modified Random Perturbation Method for Database Security” by P. Tendick, N. Matloff, ACM Transactions on Database Systems, Mar. 1994, vol. 19, No. 1, pp. 47-63, (found at http://seclab.cs.ucdavis.edu/papers.html), Mar. 1994.Applicant
- Short presentation entitled “Intrusion Detection for network infrastructures” by S. Cheung, K.N. Levitt, C. Ko. The 1995 IEEE Symposium on Security and Privacy, Oakland CA, May 1995.Applicant
- Master Thesis entitled “Paradigms for the Reduction of Audit Trails” by B. Wetmore, downloaded from http://seclab.cs.ucdavis.edu/papers.html, 1993.Applicant
- “Open System Security —an Architectural Framework” by Arto T. Karila, (found at http://www.cs.purdue.edu/coast/archive/data/categ.30.html), Jun. 1991.Applicant
- Product description for “Oil Change” located on the Internet at http://store.mcafee.com/product.asp?ProductID=28&CategoryID-12, pp. 1-2, Feb. 1999.Applicant
- NetRanger 1.3 User's Guide, Copyright © 1997 by WheelGroup Corporation, NetRanger product first available summer of 1996, 1996.Applicant
- “Information Security and Privacy in Network Environments,” by U.S. Office of Technology Assessment, OTA-TCT-606 (Washington DC: US Government Printing Office), Sep. 1994.Applicant
- “A Few Attacks on the Zero Knowledge State in Novell's Netware” by Greg Miller, pp. 1-11. (found at http://www.cs.purdue.edu/coast/archive/data/categ30.html), Jul. 30, 1996.Applicant
- “Introduction to Algorithms,” by Thomas H. Cormen, Charles E. Leiserson, Ronald L. Rivest, Chap. 34, pp. 853-885, Copyright ©1990, 1990.Applicant