The operational use of Bro at LBNL has fostered extensive related
research on network intrusion detection:
- V. Paxson, Bro: A System for
Detecting Network Intruders in Real-Time, Computer
Networks, 31(23-24), pp. 2435-2463, 14 Dec. 1999. ( HTML)
This paper is a revision of paper that
previously appeared in Proc. 7th USENIX Security Symposium
, January 1998, and the best overview paper on Bro.
-
M Vallentin, R. Sommer, J. Lee, C. Leres, V. Paxson, and B. Tierney,
The NIDS Cluster: Scalable, Stateful Network Intrusion Detection on Commodity Hardware ,
RAID 2007.
-
R. Pang, V. Paxson, R. Sommer and L. Peterson, binpac: A yacc for
Writing Application Protocol Parsers, Proc. ACM IMC, October 2006.
(PDF)
-
J. Gonzalez and V. Paxson, Enhancing Network Intrusion Detection
With Integrated Sampling and Filtering, Proc. RAID 2006.
(PDF)
-
H. Dreger, A. Feldmann, M. Mai, V. Paxson and R. Sommer,
Dynamic Application-Layer Protocol Analysis for
Network Intrusion Detection,
Proc. USENIX Security Symposium, August 2006.
(PDF)
-
S. Kornexl, V. Paxson, H. Dreger, A. Feldmann and R. Sommer,
Building a Time Machine for Efficient Recording and Retrieval of High-Volume
Network Traffic,
Proc. ACM IMC, October 2005.
(PDF)
-
S. Dharmapurikar and V. Paxson,
Robust TCP Stream Reassembly in the Presence of Adversaries,
Proc. USENIX Security Symposium 2005.
(PDF)
-
H. Dreger, C. Kreibich, V. Paxson and R. Sommer,
Enhancing the Accuracy of Network-based Intrusion Detection with
Host-based Context,
Proc. Conference on Detection of Intrusions and Malware and Vulnerability
Assessment (DIMVA) 2005.
-
R. Sommer and V. Paxson,
Exploiting Independent State For Network Intrusion Detection,
Proc. ACSAC 2005.
-
C. Kreibich and R. Sommer,
Policy-controlled Event Management for Distributed Intrusion Detection ,
4th International Workshop on Distributed Event-Based Systems (DEBS'05), 2005, Columbus/Ohio, USA.
-
J. Jung, V. Paxson, A. Berger, and H. Balakrishnan,
Fast Portscan Detection Using Sequential Hypothesis Testing,
Proc. IEEE Symposium on Security and Privacy, May 2004.
-
H. Dreger, A. Feldmann, V. Paxson, and R. Sommer,
Operational Experiences with High-Volume Network Intrusion Detection,
Proc. ACM CCS, October 2004.
-
R. Sommer and V. Paxson,
Exploiting Independent State For Network Intrusion Detection,
Technical Report TUM-I0420, Technische Universität München, November 2004.
- Y. Zhang and V. Paxson, Detecting
Stepping Stones, Proc. 9th USENIX Security Symposium,
August 2000. (HTML)
- Y. Zhang and V. Paxson, Detecting
Backdoors, Proc. 9th USENIX Security Symposium, August
2000. (HTML)
- M. Handley, C. Kreibich and V. Paxson,
Network Intrusion Detection: Evasion, Traffic Normalization, and
End-to-End Protocol Semantics (HTML). (compressed
Postscript) (PDF)
Proc. USENIX Security
Symposium 2001.
- U. Shankar and V. Paxson, Active
Mapping: Resisting NIDS Evasion Without Altering Traffic,
Proc. IEEE Symposium on Security and Privacy, May 2003.
- R. Pang and V. Paxson, A
High-level Programming Environment for Packet Trace Anonymization
and Transformation, Proc. ACM SIGCOMM 2003, August
2003.
- R. Sommer and V. Paxson, Enhancing
Byte-Level Network Intrusion Detection Signatures with
Context, Proc. ACM CCS 2003. (compressed
Postscript)
|
