Enhancing byte-level network intrusion detection signatures with context

By Robin Sommer, Vern Paxson. Conference on Computer and Communications Security, 2003

305 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Behavioural biometrics: a survey and classification (2008, background): “…systems have been developed based on the concept of network level attack detection (Novikov et al., 2006a; 2006b; Novikov, 2005; Silva et al., 2004; Sommer and Paxson, 2003; Zhang and Manikopoulos, 2003) and the general area of network traffic analysis is highly applicable for improved network and…”
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues (2013, background): “significantly improve alert descriptions [141] and reduce the false alarm rate [85].”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, background): “Network IDSs have the capacity to detect initial incoming intrusion attempts, and the prolific frequency with which they produce such alarms in operational networks is well documented [36].”
Algorithms to accelerate multiple regular expressions matching for deep packet inspection (2006, background): “In [1], Sommer and Paxson note that regular expressions might prove to be fundamentally more efficient and flexible as compared to exact-match strings when specifying attack signatures.”