A trend analysis of exploitations

Browne, H.K.; Arbaugh, William A.; McHugh, John; Fithen, William

doi:10.1109/secpri.2001.924300

Cited by 71 publications

(47 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This information should be provided as well. Finally, the age of the vulnerability is extremely relevant to assess its severity, as shown by this study of the Computer Emergency Response Team (CERT/CC) incidents database [1].…”

Section: Damage Assessment and Alert Qualificationmentioning

confidence: 99%

Evaluation of the Diagnostic Capabilities of Commercial Intrusion Detection Systems

Debar

Morin

2002

Lecture Notes in Computer Science

View full text Add to dashboard Cite

This paper describes a testing environment for commercial intrusion-detection systems, shows results of an actual test run and presents a number of conclusions drawn from the tests. Our test environment currently focuses on IP denial-of-service attacks, Trojan horse traffic and HTTP traffic. The paper focuses on the point of view of an analyst receiving alerts sent by intrusion-detection systems and the quality of the diagnostic provided. While the analysis of test results does not solely targets this point of view, we feel that the diagnostic accuracy issue is extremely relevant for the actual success and usability of intrusion-detection technology. The tests show that the diagnostic proposed by commercial intrusiondetection systems sorely lack in precision and accuracy, lacking the capability to diagnose the multiple facets of the security issues occurring on the test network. In particular, while they are sometimes able to extract multiple pieces of information from a single malicious event, the alerts reported are not related to one another in any way, thus loosing significant background information for an analyst. The paper therefore proposes a solution for improving current intrusion-detection probes to enhance the diagnostic provided in the case of an alert, and qualifying alerts in relation to the intent of the attacker as perceived from the information acquired during analysis.

show abstract

Section: Damage Assessment and Alert Qualificationmentioning

confidence: 99%

Evaluation of the Diagnostic Capabilities of Commercial Intrusion Detection Systems

Debar

Morin

2002

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…These values can be conservative, and can be refined from measures of exploit activity on the Internet (e.g., [BAMF01]). However, it is important to be consistent, and to assign similar values to vulnerabilities with similar difficulties.…”

Section: Attack Difficultymentioning

confidence: 99%

Foundations for Intrusion Prevention

Rubin¹,

Alderman²,

Vernon³

2004

PIK - Praxis der Informationsverarbeitung und Kommunikation

View full text Add to dashboard Cite

Abstract:We propose an infrastructure that helps a system administrator to identify a newly published vulnerability on the site hosts and to evaluate the vulnerability's threat with respect to the administrator's security priorities. The infrastructure foundation is the vulnerability semantics, a small set of attributes for vulnerability definition. We demonstrate that with a few attributes it is possible to define the majority of the known vulnerabilities in a way that (i) facilitates their accurate identification, and (ii) enables the administrator to rank the vulnerabilities found according to the organization's security priorities. A large scale experiment demonstrates that our infrastructure can find significant vulnerabilities even in a site with a high security awareness.

show abstract

“…Possible approaches for a quantitative perspective of exploitation trends are discussed in [9]. Probabilistic examinations of intrusions have been presented by several researchers [10,11]. In [12], Rescorla has studied vulnerabilities in open source servers.…”

Section: Introductionmentioning

confidence: 99%