Intrusion Detection and Network Monitoring

• Detecting Scanning Worms

  • D. Whyte, P.C. van Oorschot, E. Kranakis. Detecting Intra-Enterprise Scanning Worms Based on Address Resolution. Annual Computer Security Applications Conference (ACSAC'05). Dec. 2005
  • D. Whyte, E. Kranakis, P.C. van Oorschot. DNS-based Detection of Scanning Worms in an Enterprise Network. Network and Distributed System Security Symposium (NDSS'05). Feb. 2005

• Addressing Mass-Mailing Worms

  • D. Whyte, P.C. van Oorschot, E. Kranakis. Addressing Malicious SMTP-based Mass-Mailing Activity Within an Enterprise Network. Technical Report TR-05-06 (May 2005).

• Detecting Repeated Packets (possibly indicating worms)

  • P. C. van Oorschot, J.M. Robert, M. Vargas Martin. A Monitoring System for Detecting Repeated Packets with Applications to Computer Worms. International Journal of Information Security (to appear). 2006

• Intrusion Detection on Email

  • Y. Li, A. Somayaji. Securing Email Archives through User Modeling. Annual Computer Security Applications Conference (ACSAC'05). Dec. 2005

• Network Awareness, Classification and Visualization

  • E. Hughes, A. Somayaji. Towards Network Awareness. Large Installation System Administration Conference (LISA'05). Dec. 2005