@conference {18667,
	title = {Characterizing Attackers and Attacks: An Empirical Study},
	year = {2011},
	month = {2011/12//},
	pages = {174 - 183},
	abstract = {This paper describes an empirical research study to characterize attackers and attacks against targets of opportunity. A honey net infrastructure was built and deployed over 167 days that leveraged three different honey pot configurations and a SSH-based authentication proxy to attract and follow attackers over several weeks. A total of 211 attack sessions were recorded and evidence was collected at each stage of the attack sequence: from discovery to intrusion and exploitation of rogue software. This study makes two important contributions: 1) we introduce a new approach to measure attacker skills, and 2) we leverage keystroke profile analysis to differentiate attackers beyond their IP address of origin.},
	keywords = {attack sessions, attacker characterization, attacker skill measurement, honey net infrastructure, honey pot configurations, IP address, keystroke profile analysis, opportunity target, rogue software exploitation, security of data, SSH-based authentication proxy},
	doi = {10.1109/PRDC.2011.29},
	author = {Salles-Loustau,G. and Berthier,R. and Collange,E. and Sobesto,B. and Michel Cukier}
}
@conference {18657,
	title = {An experimental evaluation to determine if port scans are precursors to an attack},
	year = {2005},
	month = {2005/07/01/june},
	pages = {602 - 611},
	abstract = {This paper describes an experimental approach to determine the correlation between port scans and attacks. Discussions in the security community often state that port scans should be considered as precursors to an attack. However, very few studies have been conducted to quantify the validity of this hypothesis. In this paper, attack data were collected using a test-bed dedicated to monitoring attackers. The data collected consist of port scans, ICMP scans, vulnerability scans, successful attacks and management traffic. Two experiments were performed to validate the hypothesis of linking port scans and vulnerability scans to the number of packets observed per connection. Customized scripts were then developed to filter the collected data and group them on the basis of scans and attacks between a source and destination IP address pair. The correlation of the filtered data groups was assessed. The analyzed data consists of forty-eight days of data collection for two target computers on a heavily utilized subnet.},
	keywords = {attack data collection, computer crime, filtered data groups, ICMP scans, IP address, IP networks, management traffic, port scans, telecommunication security, Telecommunication traffic, vulnerability scans},
	doi = {10.1109/DSN.2005.18},
	author = {Panjwani,S. and Tan,S. and Jarrin,K.M. and Michel Cukier}
}
@conference {12076,
	title = {Bootstrapping security associations for routing in mobile ad-hoc networks},
	booktitle = {IEEE Global Telecommunications Conference, 2003. GLOBECOM {\textquoteright}03},
	volume = {3},
	year = {2003},
	month = {2003/12/01/5},
	pages = {1511- 1515 vol.3 - 1511- 1515 vol.3},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {To date, most solutions proposed for secure routing in mobile ad-hoc networks (MANETs), assume that secure associations between pairs of nodes can be established on-line; e.g., by a trusted third party, by distributed trust establishment. However, establishing such security associations, with or without trusted third parties, requires reliance on routing layer security. In this paper, we eliminate this apparent cyclic dependency between security services and secure routing in MANETs and show how to bootstrap security for the routing layer. We use the notion of statistically unique and cryptographically verifiable (SUCV) identifiers to implement a secure binding between IP addresses and keys that is independent of any trusted security service. We illustrate our solution with the dynamic source routing (DSR) protocol and compare it with other solutions for secure routing.},
	keywords = {ad hoc networks, bootstrapping security association, Cryptographic protocols, dynamic source routing protocol, Fabrics, Intelligent networks, IP address, IP key, IP networks, Message authentication, mobile ad-hoc network, mobile radio, Protection, Public key, public key cryptography, routing layer security reliability, routing protocols, secure routing, Security, security service, statistically unique cryptographically verification, telecommunication security},
	isbn = {0-7803-7974-8},
	doi = {10.1109/GLOCOM.2003.1258490},
	author = {Bobba,R. B and Eschenauer,L. and Gligor,V. and Arbaugh, William A.}
}
