@conference {18654,
	title = {An empirical study of filesystem activity following a SSH compromise},
	year = {2007},
	month = {2007/12//},
	pages = {1 - 5},
	abstract = {Monitoring filesystem data is a common method used to detect attacks. Once a computer is compromised, attackers will likely alter files, add new files or delete existing files. The changes that attackers make may target any part of the filesystem, including metadata along with files (e.g., permissions, ownerships and inodes). In this paper, we describe an empirical study that focused on SSH compromised attacks. First statistical data on the number of files targeted and the associated activity (e.g., read, write, delete, ownership and rights) is reported. Then, we refine the analysis to identify and understand patterns in the attack activity.},
	keywords = {attack activity, filesystem activity, filesystem data monitoring, intrusion detection systems evaluation, meta data, metadata, security of data, SSH compromised attacks},
	doi = {10.1109/ICICS.2007.4449675},
	author = {Molina,J. and Gordon,J. and Chorin,X. and Michel Cukier}
}
@conference {18674,
	title = {Filesystem activity following a SSH compromise: an empirical study of file sequences},
	series = {ICISC{\textquoteright}07},
	year = {2007},
	month = {2007///},
	pages = {144 - 155},
	publisher = {Springer-Verlag},
	organization = {Springer-Verlag},
	address = {Berlin, Heidelberg},
	abstract = {A common method used to detect intrusions is monitoring filesystem data. Once a computer is compromised, an attacker may alter files, add new files or delete existing ones. Attackers may target any part of the filesystem, including metadata along with files (e.g., permissions, ownerships and inodes). In this paper, we will describe an empirical study that focused on computer attack activity after a SSH compromise. Statistical data will be provided on the number of files targeted and the associated activity (e.g., read, write, delete, ownership and rights). We extend this analysis to include the sequence of files and activities targeted. We focused on the most frequent sequences of consecutive files and activities, then explored in greater detail the longer sequences using state machines. Finally, we developed a simple state machine representing three major observed attack activities (i.e., reconnaissance, malware download and password change) with the number of transitions and time for each transition. The analysis of individual and sequences of files and activities will help to better understand attack activity patterns resulting in more efficient intrusion detection.},
	keywords = {filesystem data, host intrusion detection systems, intrusion detection systems evaluation, SSH compromises},
	isbn = {3-540-76787-8, 978-3-540-76787-9},
	url = {http://dl.acm.org/citation.cfm?id=1775532.1775548},
	author = {Molina,Jesus and Chorin,Xavier and Michel Cukier}
}
