Introduction

The Call For Papers was asking extended abstracts but many authors have sent us full papers as well.

The papers are presented by session, in the same order as in the hard copies of the proceedings that had been distributed at RAID99.

Session 1

• Misuse Detection in Database Systems Through User Profiling, C. Chung, M. Gertz, K. Levitt (University of California Davis, USA);
  extended abstract with biographies is available on line.
• Audit logs: to keep or not to keep?, Christopher Wee (University of California Davis, USA);
  extended abstract with biography is available on line.

Session 2: Agent-based Detection Systems

• Micael: An Autonomous Mobile Agent System to Protect New Generation Networked Applications, Jose Duarte de Queiroz, Luiz Fernando Rust da Costa Carmo, Luci Pirmez (Nucleo de Computacao Eletronica UFRJ, Brazil)
  full paper is available on line.
• Mobile Agent Attack Resistant Distributed Hierarchical Intrusion Detection Systems, Peter Mell, Mark McLarnon (National Institute of Standards and Technology, USA)
  full paper is available on line.
• New directions for the AAFID architecture, Eugene Spafford, Diego Zamboni (Center for Education and Research in Information Assurance and Security Purdue University, USA)
  extended abstract with biographies is available on line.

Session 3: Knowledge Engineering and IDS

• Combining Knowledge Discovery and Knowledge Engineering to Build IDSs, Wenke Lee (North Carolina State University, USA), Salvatore J. Stolfo (Columbia University, USA);
  extended abstract with biographies is available on line.
• A Data Mining Analysis of RTID Alarms, Stefanos Manganaris, Marvin Christensen, Dan Zerkle, Keith Hermiz (IBM, USA)
  full paper is available on line.
• Intrusion Detection Inter-component Adaptive Negotiation, Feiertag et al. (USA)
  extended abstract with biographies is available on line.
• Building an Intrusion-Detection System to Detect Suspicious Process Behavior, Andreas Wespi and Herve Debar (IBM, Switzerland).
  extended abstract with biographies is available on line.

Session 4: IDS and Law

• Towards trapping wily intruders in the large Glenn Mansfield (Japan).
  full paper is available on line.

Session 5: Standards, Assessment, and Lessons Learned

• Defending against network IDS evasion , V. Paxson (Lawrence Berkeley Labs, USA)
  extended abstract with biographies is available on line.
• IDS Standards: Lessons Learned to Date , S. Staniford-Chen (Silicon Defense, USA)
  extended abstract with biographies is available on line.
• Results of the DARPA 1998 Offline Intrusion Detection Evaluation , Lippmann et al. (USA)
  extended abstract with biographies is available on line.
  slides presented at RAID99 are also available on line.
• Lessons Learned in Commercial IDS Development , T. Farley (Internet Security Systems, USA)
  extended abstract with biographies is available on line.
• Air Force Intrusion Detection System Evaluation Environment , T. Champion, R. Durst (Air Force Research Lab, USA)
  full paper is available on line.

Session 6: Vulnerability Definitions

• Nidsbench - a Network Intrusion Detection Test Suite D. Song, G. Shaffer, M. Undy (Anzen Computing, USA)
  extended abstract with biographies is available on line.
• Vulnerability Analysis: An Extended Abstract Bishop (University of California Davis, USA)
  extended abstract with biography is available on line.
• The Development of a Common Vulnerability Enumeration S. Christey, D. Mann, W. Hill (The MITRE Corporation, USA)
  full paper is available on line.

Session 7: Overarching Concerns

• Privacy vs. Intrusion Detection Analysis E. Lundin, E. Jonnson (Chalmers University of Technology, Sweden)
  full paper is available on line.
• On a Difficulty of Intrusion Detection , S. Axelsson (Chalmers University of Technology, Sweden).
  full paper is available on line.
• Intrusion Detection, Internet Law Enforcement and Insurance Coverage to Accelerate the Proliferation of Internet Business , C. Ting, T. Ong, Y. Tan, P. Ng (DSO National Laboratories, Singapore)
  full paper is available on line.
• Intrusion Detection for Telephony Signalling , D. Gorman (Electronic Systems Division GTE, USA), M. Ruhl (Office of INFOSEC Research NSA, USA)
  extended abstract with biographies is available on line.
• Minimizing Bandwidth for Remote Access to Cryptographically Protected Audit Logs , J. Kelsey, B. Schneier (Counterpane Internet Security Inc., USA)
  full paper is available on line.

Session 8

• Anomaly Intrusion Detection Systems: Handling Temporal Relations Between Events , A. Seleznyov, S. Puuronen (University of Jyvaskyla, Finland)
  full paper is available on line.
• Improving Intrusion Detection Performance using Keyword Selection and Neural Networks , R. Lippmann, S. Cunningham (MIT Lincoln Laboratory, USA)
  full paper is available on line.
  slides presented at RAID99 are also available on line.
• Intrusion Detection Mechanism to Detect Reachability Attacks in PNNI Networks Y. Cosendai, M. Dacier, P. Scotton (IBM, Switzerland)
  extended abstract with biographies is available on line.
• Session State Transition Based Large Network IDS , Z. Qianli, L. Xing (CERNET Center, China)
  extended abstract with biographies is available on line.
• Defending against a Denial-of-Service Attack on TCP , P. Mutaf (Izmir Institute of Technology, Turkey)
  full paper is available on line.

Session 9

• Intrusion Detection for an On-Going Attack Yuill et al. (USA)
  full paper is available on line.
• Intrusion Detection and Isolation Protocol: Automated Response to Attacks Rowe (University of California Davis, USA)
  extended abstract with biography is available on line.
• A Study in the Feasibility of Performing Host-Based Anomaly Detection on Windows NT A. Schwartzbard, A. Ghosh (Reliable Software Technologies Corporation, USA).

Session 10

• SNMS - Shadow Network Management System T. Ong et al. (DSO National Laboratories, Singapore)
  full paper is available on line.