The Internet has brought with it a whole revolution and new challenges that were previously unanticipated.  Countries, both small and large, face a myriad of challenges in teh legal, policy, and technical realms….

Critical infrastructure protection is not only a national problem but, because so many parts of the infrastructure are connected, it’s also a global one and international fora such as this will go a long way, we believe, in helping us deal with this significant challenge…

The concept of one event happening before another in a distributed system is examined, and is shown to define a partial ordering of the events.  A distributed algorithm is given for synchronizing a system of logical clocks which can be used to totally order the events…

The Intrusion Detection and Response Data Sharing Workshop, held at the Universityof California at Davis on July 15, 1998, had three goals.  First, identify the needs of practitioners and researchers and identify opportunities for co-operation.  Secondly, broker exchanges of research prototypes and better products to practitioners, and real incident data to researchers.  Thirdly, provide funding agencies with a set of hard research problems for possible future funding.

The Computer Misuse Detection System is a computer security product that enables real-time detection of unauthorized computer use through audit data analysis.  Audit data analysis is a non-invasive method for secuirty assurance that may be used to detect computer misuse and mitigate security risks in large, distributed, open architecture environments…..

Next generation cyberspace intrusion detection systems will fuse data from heterogeneous distributed network sensors o create cyberspace situational awareness.  This paper provides a few first steps toward developing the engineering requirements using the art and science of multisensor data fusion as the underlying model.  Current generations internet-based intrusion detection systems and basic multisensor data fusion constructs are summarized.  The TCP/IP model is used to develop framework sensor and database models.  The SNMP ASN.1 MIB construct is recommended for the representation of context-dependent threat & vulnerabilities databases.

The Internet protocol suit TCP/IP, was first proposed fifteen years ago.  It was developed by the Defense Advanced Research Projects Agency (DARPA), and has been papers and specifications that describe how the protocols work, it is sometimes difficult to deduce from these why the protocol is as it is.  For example, the Internet protocol is based on a connectionless or datagram mode of service.  The motivation for this has been greatly misunderstood.  This paper attempts to capture some of the early reasoning which has shaped the Internet protocols.

We propose a distributed architecture agents to monitor security-related activity within a within a network. Each agent operates cooperatively yet independently of the others, providing for efficiency, real-time response and distribution of resources.  This architecture provides significant advantages in scalability, flexibility, extensibility, fault tolerance, and resistance to compromise. We also propose a scheme of escalating levels of alertness, and a way to notify other agents on other computers in a network of attacks so they can take preemptive or reaction measures.  We designed a neutral network to measure and determine alert threshold values.  A communication protocols proposed to relay these alerts throughout the network.  We illustrate our design with a detailed scenario.

In June 2000, a major new class of vulnerabilities called \“format bugs\” was discovered when a vulnerability in WU-FTP appeared that acted almost like a buffer over-flow, but wasn\‘t.  Since then, dozens of format string vulnerabilities have appeared.  This paper describes format bug problem, and presents FormatGuard: our proposed solution….

This paper describes a real-time intrusion-detection system (IDES) that observes user behavior on a monitored computer system and adaptively learns what is normal for individual users, groups, remote hosts, and the overall system behavior.  Observed behavior is flagged as a potential intrusion if it deviates significantly from the expected behavior or if it triggers a rule in the expert-system rule base…

Whereas the maximal amount of information that a certain algorithm can ``hide\” (while keeping the data within allowable distortion bounds) is certainly related to the ability to assert ownership in court, it is not directly measuring its ``power of persuasion\”, in part also because it doesn\‘t consider directly the existence and power of watermarking attacks.
  In this paper we show why, due to its particularities, watermarking requires a different metric, more closely related to its ultimate purpose, claiming ownership in a court of law. We define one suitable metric ({\\em watermarking power}) and show how it relates to derivates of hiding capacity. We prove that there are cases where considering hiding capacity is sub-optimal as a metric in evaluating watermarking methods whereas the metric of {\\em watermarking power} delivers good results.