This workshop, the first in an anticipated annual series, will bring together leading figures from academia, government, and industry to talk about the current state of intrusion detection technologies and paradigms from the research and commercial perspectives.

Research into and development of automated Intrusion Detection Systems (IDS) has been under way for nearly 10 years. By now a number of systems have been deployed in the commercial or government arenas, but all are limited in what they do. At the same time, the numerous research and prototype systems developed have been more engineering than scientific efforts, with scant quantitative performance figures. As we survey the field of automated intrusion detection, we are faced with many questions:

1. What research questions have yet to be answered (or even asked) about IDS?
2. What are the open challenges, limitations, and fundamental concerns about present intrusion detection methodologies?
3. What metrics can we use to measure IDS performance and thus compare different systems and methodologies? These measurements should highlight the successes and expose the limitations of current IDS approaches.
4. What factors are inhibiting transfer of research ideas into functional deployed systems? How can those be addressed?
5. What is the role of a deployed IDS? How should or can it fit in with other security systems?
6. What are the typical IDS operating environments? What can be done to configure IDS to unique operating environments?
7. What are the challenges for IDS in very large environments, such as the Internet?
8. Is it time to contemplate IDS standards? What are the advantages and disadvantages of standardizing components of IDS? What forums (e.g., IETF, ISO) would be appropriate for pursuing such standards?
9. What are the problems of turning the results of intrusion detection tools into legally reliable evidence? What are the problems of admissibility and of courtroom presentation?

1. New results related to intrusion detection methodologies and technologies.
2. Innovative ways of thinking about intrusion detection; for example, the applicability of R&D in the fields of survivable and/or dependable systems, data mining, etc.
3. User experiences and lessons learned from fielded intrusion detection systems.
4. IDS for emerging computer environments (e.g., Java, CORBA, and NT).
5. Commercial intrusion detection systems.

PROGRAM COMMITTEE

LOCAL ORGANIZATION COMMITTEE

SUBMISSIONS

Each talk or panel submission must contain:

1. A separate title page with:
• The type of submission (talk or panel);
• The title or topic; and
• The name(s) of the speaker or panel chair and probable panelists, with their organizational affiliation(s), telephone and FAX numbers, postal address, and Internet electronic mail address.
2. A brief biography of each participant.
3. The time desired for the talk or panel.

Panel proposals must also include a description that is a maximum of 300 words, the format of the presentation, and short rationale for the panel. The program committee will allocate accepted panel sessions one to two-hour time slots, based on the complexity and interest of the proposed topic, the number of panelists, and the wishes of the panel chair. The panel chair will be informed the slot length when notified of acceptance.

All proposals must be in English. Plan to give all panels and talks in English.

We must receive all proposals before June 15, 1998. We strongly prefer they be submitted by e-mail to raid98@zurich.ibm.com. Various formats (ASCII, postscript, Word, WordPro, Framemaker, and LaTex) are acceptable. If necessary, hardcopy proposals may be sent to:

Each submission will be acknowledged by e-mail. If acknowledgment is not received within seven days, please contact the one of the General Co-Chairs.

A preliminary program will be available at the RAID web site by August 1, 1998.

CORPORATE SPONSORS

REGISTRATION

Travel instructions to Louvain-la-Neuve are available on the web (courtesy of the UCL Crypto Group).

Registration will close on 21 August 1998. Late registration will continue until 4 September 1998, but only on a space-available basis, and will include a penalty of 50 US$ (in addition to the fees specified below).

Fees will be levied on a sliding scale, as follows:

Student	200 US$
Speaker or Panel Member	250 US$
General attendance	350 US$

This fee will include workshop sessions, banquet, hosted reception, luncheons, light breakfast service, and coffee and refreshment breaks. There will be no special rate for one-day or other limited attendance. Payment in full will be required at registration.

We are negotiating a registration discount for those attending both the ESORICS conference and the RAID or CARDIS workshops, and for interchangeable workshop registration. Further information will be available when detailed registration information is posted.

PROCEEDINGS

1. The final program;
2. A list of corporate sponsors;
3. A list of attendees (subject to each attendee’s approval);
4. The submitted abstract and slides used by each speaker;
5. The submitted description and rationale for each panel;
6. The slides used by each panelist; and,
7. Written position statements from each panelist.

IMPORTANT DATES

MORE INFORMATION