@conference {18669,
	title = {Evaluating Files to Audit for Detecting Intrusions in FileSystem Data},
	year = {2009},
	month = {2009/07//},
	pages = {163 - 170},
	abstract = {Monitoring filesystem data is a common method used to detect intrusions. Once a computer is compromised, an attacker may alter files, add new files or delete existing files. The changes that attackers make may target any part of the filesystem, including metadata along with files (e.g., permissions, ownerships and inodes). The accuracy of detecting an intrusion depends on the data audited: if an intrusion does not manifest in the data, the intrusion will not be detected. Moreover, not all files, which contain filesystem activity, are suitable to detect intrusions, as some may fail to provide useful information. In this paper, we describe an empirical study that focused on filesystem attack activity after a SSH compromise. Three types of attacker action are considered: reconnaissance, password modification, and malware download. For each type of action, we evaluated the files to audit using metrics derived from the field of information theory and estimated with the empirical SSH compromise data.},
	keywords = {authorisation, Bayes methods, Bayesian metric, data auditing, empirical SSH compromise data, Entropy, entropy-based metric, file evaluation, file organisation, filesystem attack activity, filesystem data monitoring, honeypot, information theory, intrusion detection system, invasive software, malware download, meta data, optimisation, optimization problem, password modification, probability, reconnaissance action, unauthorized user},
	doi = {10.1109/NCA.2009.38},
	author = {Molina,J. and Michel Cukier}
}
@conference {15856,
	title = {Replication and automation of expert judgments: Information engineering in legal e-discovery},
	booktitle = {IEEE International Conference on Systems, Man and Cybernetics, 2009. SMC 2009},
	year = {2009},
	month = {2009/10/11/14},
	pages = {102 - 107},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {The retrieval of digital evidence responsive to discovery requests in civil litigation, known in the United States as {\~A}{\^A}{\textquestiondown}e-discovery,{\~A}{\^A}{\textquestiondown} presents several important and understudied conditions and challenges. Among the most important of these are (i) that the definition of responsiveness that governs the search effort can be learned and made explicit through effective interaction with the responding party, (ii) that the governing definition of responsiveness is generally complex, deriving both from considerations of subject-matter relevance and from considerations of litigation strategy, and (iii) that the result of the search effort is a set (rather than a ranked list) of documents, and sometimes a quite large set, that is turned over to the requesting party and that the responding party certifies to be an accurate and complete response to the request. This paper describes the design of an {\~A}{\^A}{\textquestiondown}interactive task{\~A}{\^A}{\textquestiondown} for the text retrieval conference{\textquoteright}s legal track that had the evaluation of the effectiveness of e-discovery applications at the {\~A}{\^A}{\textquestiondown}responsive review{\~A}{\^A}{\textquestiondown} task as its goal. Notable features of the 2008 interactive task were high-fidelity human-system task modeling, authority control for the definition of {\~A}{\^A}{\textquestiondown}responsiveness,{\~A}{\^A}{\textquestiondown} and relatively deep sampling for estimation of type 1 and type 2 errors (expressed as {\~A}{\^A}{\textquestiondown}precision{\~A}{\^A}{\textquestiondown} and {\~A}{\^A}{\textquestiondown}recall{\~A}{\^A}{\textquestiondown}). The paper presents a critical assessment of the strengths and weaknesses of the evaluation design from the perspectives of reliability, reusability, and cost-benefit tradeoffs.},
	keywords = {authorisation, authority control, Automation, civil litigation, CYBERNETICS, Delay, digital evidence retrieval, discovery request, Educational institutions, expert judgment automation, Human computer interaction, Human-machine cooperation and systems, human-system task modeling, information engineering, Information retrieval, interactive task, Law, law administration, legal e-discovery, Legal factors, PROBES, Production, Protocols, search effort, Search methods, text analysis, text retrieval conference legal track, United States, USA Councils, User modeling},
	isbn = {978-1-4244-2793-2},
	doi = {10.1109/ICSMC.2009.5346118},
	author = {Hedin,B. and Oard, Douglas}
}
@conference {14654,
	title = {A secure PLAN (extended version)},
	booktitle = {DARPA Active NEtworks Conference and Exposition, 2002. Proceedings},
	year = {2002},
	month = {2002///},
	pages = {224 - 237},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {Active networks promise greater flexibility than current networks, but threaten safety and security by virtue of their programmability. We describe the design and implementation of a security architecture for the active network PLANet (Hicks et al., 1999). Security is obtained with a two-level architecture that combines a functionally restricted packet language, PLAN (Hicks et al., 1998), with an environment of general-purpose service routines governed by trust management (Blaze et al., 1996). In particular, we employ a technique which expands or contracts a packet{\textquoteright}s service environment based on its level of privilege, termed namespace-based security. As an application of our security architecture, we present the design and implementation of an active-network firewall. We find that the addition of the firewall imposes an approximately 34\% latency overhead and as little as a 6.7\% space overhead to incoming packets},
	keywords = {active internetwork, active networks, active-network firewall, Authentication, authorisation, Authorization, Cities and towns, Computer networks, Computer science, cryptography, functionally restricted packet language, general-purpose service routines, Information security, internetworking, IP networks, latency overhead, namespace-based security, PLAN, PLANet, Planets, programmability, Safety, security architecture, telecommunication security, trust management, two-level architecture, Web and internet services},
	isbn = {0-7695-1564-9},
	doi = {10.1109/DANCE.2002.1003496},
	author = {Hicks, Michael W. and Keromytis,A. D and Smith,J. M}
}
