be06.bbl
\begin{thebibliography}{10}

\bibitem{Bac00}
Bace, R.:
\newblock Intrusion detection.
\newblock Macmillan Publishing Co., Inc. (2000)

\bibitem{DDW00}
Debar, H., Dacier, M., Wespi, A.:
\newblock A revised taxonomy for intrusion detection systems.
\newblock Annales des T{\'e}l{\'e}communications \textbf{55}(7--8) (2000)
  361--378

\bibitem{ACFM+00}
Allen, J., Christie, A., Fithen, W., McHugh, J., Pickel, J., Stoner, E.:
\newblock State of the practice of intrusion detection technologies.
\newblock Technical Report CMU/SEI-99TR-028, Carnegie-Mellon University -
  Software Engineering Institute (2000)

\bibitem{MCZH00}
Manganaris, S., Christensen, M., Zerkle, D., Hermiz, K.:
\newblock A {D}ata {M}ining {A}nalysis of {RTID} alarms.
\newblock Computer Networks: The International Journal of Computer and
  Telecommunications Networking \textbf{34}(4) (2000)  571--577

\bibitem{NX03}
Ning, P., Xu, D.:
\newblock Learning attack strategies from intrusion alerts.
\newblock In: CCS '03: Proc.~10th ACM conference on Computer and Communications
  Security, ACM Press (2003)  200--209

\bibitem{Axe00}
Axelsson, S.:
\newblock The base-rate fallacy and the difficulty of intrusion detection.
\newblock ACM Trans.~Inf.~Syst.~Secur.~(TISSEC) \textbf{3}(3) (2000)  186--205

\bibitem{CG00}
Clifton, C., Gengo, G.:
\newblock Developing custom intrusion detection filters using data mining.
\newblock In: MILCOM '00: Proc.~21st Century Military Communications
  Conference. Volume~1., IEEE Computer Society Press (2000)  440--443

\bibitem{Jul01}
Julisch, K.:
\newblock {M}ining {A}larm {C}lusters to {I}mprove {A}larm {H}andling
  {E}fficiency.
\newblock In: ACSAC '01: Proc.~17th Annual Computer Security Applications
  Conference (ACSAC), ACM Press (2001)  12--21

\bibitem{Jul03}
Julisch, K.:
\newblock Clustering intrusion detection alarms to support root cause analysis.
\newblock ACM Transactions on Information and System Security (TISSEC)
  \textbf{6}(4) (2003)  443--471

\bibitem{DC02}
Dain, O., Cunningham, R.:
\newblock {F}using {H}eterogeneous {A}lert {S}treams into {S}cenarios.
\newblock In: Proc.~Workshop on Data Mining for Security Applications, 8th ACM
  Conference on Computer Security (CCS' 01), ACM Press (2002)  1--13

\bibitem{Axe99}
Axelsson, S.:
\newblock {Intrusion Detection Systems: A Survey and Taxonomy}.
\newblock Technical Report 99-15, Chalmers University (2000)

\bibitem{Roe99}
Roesch, M.:
\newblock {S}nort - {L}ightweight {I}ntrusion {D}etection for {N}etworks.
\newblock In: LISA '99: Proc.~13th USENIX Conference on System Administration,
  USENIX Association (1999)  229--238

\bibitem{snort}
Sourcefire:
\newblock Snort {N}etwork {I}ntrusion {D}etection {S}ystem web site (1999) URL
  http://www.snort.org.

\bibitem{LHFK+00}
Lippmann, R., Haines, J.W., Fried, D.J., Korba, J., Das, K.:
\newblock The 1999 {DARPA} off-line intrusion detection evaluation.
\newblock Computer Networks: The International Journal of Computer and
  Telecommunications Networking \textbf{34}(4) (2000)  579--595

\bibitem{Pie04}
Pietraszek, T.:
\newblock Using {A}daptive {A}lert {C}lassification to {R}educe {F}alse
  {P}ositives in {I}ntrusion {D}etection.
\newblock In Jonsson, E., Valdes, A., Almgren, M., eds.: RAID '04: Proc.~7th
  Symposium on Recent Advances in Intrusion Detection. Volume 3224 of LNCS.,
  Springer-Verlag (2004)  102--124

\bibitem{DDW99}
Debar, H., Dacier, M., Wespi, A.:
\newblock Towards a taxonomy of intrusion-detection systems.
\newblock Computer Networks \textbf{31}(8) (1999)  805--822

\bibitem{wasc}
{Web Application Security Consortium}:
\newblock {W}eb {S}ecurity {T}hreat {C}lassification (2005) URL
  http://www.webappsec.org/projects/threat/.

\bibitem{Tre68}
van Trees, H.L.:
\newblock Detection, {E}stimation and {M}odulation {T}heory. {P}art {I}:
  {D}etection, {E}stimation, and {L}inear {M}odulation {T}heory.
\newblock John Wiley and Sons, Inc. (1968)

\bibitem{owasp10}
{The Open Web Application Security Project}:
\newblock {OWASP Top Ten Most Critical Web Application Security
  Vulnerabilities} (2006) URL http://www.owasp.org/documentation/topten.html.

\bibitem{postNukeExploit}
{Security Reason}:
\newblock {PostNuke} {I}nput {V}alidation {E}rror (2005) URL
  http://securitytracker.com/alerts/2005/May/1014066.html.

\bibitem{postnuke}
PostNuke:
\newblock {P}ost{N}uke {C}ontent {M}anagament {S}ystem (2006) URL
  http://www.postnuke.com/.

\bibitem{checkpoint}
{Check Point Software Technologies}:
\newblock {Stateful Inspection Technology} (2005) URL
  http://www.checkpoint.com/products/downloads/Stateful\_Inspection.pdf.

\bibitem{BZEH06}
Bolzoni, D., Zambon, E., Etalle, S., Hartel, P.:
\newblock {POSEIDON}: a 2-tier {A}nomaly-based {N}etwork {I}ntrusion
  {D}etection {S}ystem.
\newblock In: IWIA '06: Proc.~4th IEEE International Workshop on Information
  Assurance, IEEE Computer Society (2006) To appear.

\bibitem{WS04}
Wang, K., Stolfo, S.J.:
\newblock Anomalous {P}ayload-{B}ased {N}etwork {I}ntrusion {D}etection.
\newblock In Jonsson, E., Valdes, A., Almgren, M., eds.: RAID '04: Proc.~7th
  Symposium on Recent Advances in Intrusion Detection. Volume 3224 of LNCS.,
  Springer-Verlag (2004)  203--222

\bibitem{McH00}
McHugh, J.:
\newblock {T}esting {I}ntrusion {D}etection {S}ystems: a critique of the 1998
  and 1999 {DARPA} intrusion detection system evaluations as performed by
  {L}incoln {L}aboratory.
\newblock ACM Transactions on Information and System Security (TISSEC)
  \textbf{3}(4) (2000)  262--294

\bibitem{MC03}
Mahoney, M.V., Chan, P.K.:
\newblock An {A}nalysis of the 1999 {DARPA}/{L}incoln {L}aboratory {E}valuation
  {D}ata for {N}etwork {A}nomaly {D}etection.
\newblock In Vigna, G., Kruegel, C., Jonsson, E., eds.: RAID '03: Proc.~6th
  Symposium on Recent Advances in Intrusion Detection. Volume 2820 of LNCS.,
  Springer-Verlag (2003)  220--237

\bibitem{symantec}
{Symantec Corporation}:
\newblock {I}nternet {S}ecurity {T}hreat {R}eport (2006) URL
  https://enterprise.symantec.com/enterprise/whitepaper.cfm?id=2238.

\bibitem{QW02}
Qiao, Y., Weixin, X.:
\newblock A {N}etwork {IDS} with {L}ow {F}alse {P}ositive {R}ate.
\newblock In Fogel, D.B., El-Sharkawi, M.A., Yao, X., Greenwood, G., Iba, H.,
  Marrow, P., Shackleton, M., eds.: CEC '02: Proc.~IEEE Congress on
  Evolutionary Computation, IEEE Computer Society Press (2002)  1121--1126

\bibitem{NRC01}
Ning, P., Reeves, D., Cui, Y.:
\newblock Correlating {A}lerts {U}sing {P}rerequisites of {I}ntrusions.
\newblock Technical Report TR-2001-13, North Carolina State University (2001)

\bibitem{NC02}
Ning, P., Cui, Y.:
\newblock An {I}ntrusion {A}lert {C}orrelator {B}ased on {P}rerequisites of
  {I}ntrusions.
\newblock Technical Report TR-2002-01, North Carolina State University (2002)

\bibitem{NCR02a}
Ning, P., Cui, Y., Reeves, D.:
\newblock Analyzing intensive intrusion alerts via correlation.
\newblock In Wespi, A., Vigna, G., Deri, L., eds.: RAID '02: Proc.~5th
  Symposium on Recent Advances in Intrusion Detection. Volume 2516 of LNCS.,
  Springer-Verlag (2002)  74--94

\bibitem{NCRX04}
Ning, P., Cui, Y., Reeves, D.S., Xu, D.:
\newblock Techniques and tools for analyzing intrusion alerts.
\newblock ACM Transactions on Information and System Security (TISSEC)
  \textbf{7}(2) (2004)  274--318

\bibitem{defcon}
DEFCON8:
\newblock Defcon {C}apture the {F}lag ({CTF}) contest (2000) URL
  http://www.defcon.org/html/defcon-8/defcon-8-post.html, data set
  http://wi2600.org/mediawhore/mirrors/shmoo/.

\bibitem{MMDD02}
Morin, B., M{\'e}, L., Debar, H., Ducass{\'e}, M.:
\newblock M2d2: A formal data model for ids alert correlation.
\newblock In Wespi, A., Vigna, G., Deri, L., eds.: RAID '02: Proc.~5th
  Symposium on Recent Advances in Intrusion Detection. Volume 2516 of LNCS.,
  Springer-Verlag (2002)  115--127

\bibitem{LS00}
Lee, W., Stolfo, S.J.:
\newblock A {F}ramework for {C}onstructing {F}eatures and {M}odels for
  {I}ntrusion {D}etection {S}ystems.
\newblock ACM Transactions on Information and System Security \textbf{3}(4)
  (2000)  227--261

\bibitem{AS95}
Agrawal, R., Srikant, R.:
\newblock Mining sequential patterns.
\newblock In: Proc.~7th International Conference on Data Engineering, IEEE
  Computer Society Press (1995)  3--14

\bibitem{HPY00}
Han, J., Pei, J., Yin, Y.:
\newblock Mining frequent patterns without candidate.
\newblock In: SIGMOD '00: Proc.~19th ACM SIGMOD International Conference on
  Management of Data, ACM Press (2000)  1--12

\bibitem{LFGH+00}
Lippmann, R., Fried, D., Graf, I., Haines, J., Kendall, K., McClung, D., Weber,
  D., Webster, S., Wyschogrod, D., Cunningham, R., Zissman, M.:
\newblock Evaluating {I}ntrusion {D}etection {S}ystems: {T}he 1998 {DARPA}
  {O}ff-line {I}ntrusion {D}etection {E}valuation.
\newblock In: DISCEX '00: Proc.~1st {DARPA} Information Survivability
  Conference and Exposition. Volume~2., IEEE Computer Society Press (2000)
  12--26

\bibitem{PT05}
Pietraszek, T., Tanner, A.:
\newblock {Data Mining and Machine Learning -- Towards Reducing False Positives
  in Intrusion Detection}.
\newblock Information Security Technical Report \textbf{10}(3) (2005)  169--183

\bibitem{MT96}
Mannila, H., Toivonen, H.:
\newblock {D}iscovering {G}eneralized {E}pisodes {U}sing {M}inimal
  {O}ccurrences.
\newblock In: KDD '96: Proc.~2nd International Conference on Knowledge
  Discovery and Data Mining, AAAI Press (1996)  146--151

\bibitem{MTV97}
Mannila, H., Toivonen, H., {Inkeri Verkamo}, A.:
\newblock {D}iscovery of {F}requent {E}pisodes in {E}vent {S}equences.
\newblock Data Min. Knowl. Discov. \textbf{1}(3) (1997)  259--289

\bibitem{JD02}
Julisch, K., Dacier, M.:
\newblock Mining intrusion detection alarms for actionable knowledge.
\newblock In: KDD '02: Proc.~8th ACM SIGKDD international conference on
  Knowledge Discovery and Data Mining, ACM Press (2002)  366--375

\bibitem{Hof99}
Hofmeyr, S.A.:
\newblock An {I}mmunological {M}odel of {D}istributed {D}etection and its
  {A}pplication to {C}omputer {S}ecurity.
\newblock PhD thesis, University of New Mexico (1999) URL
  http://www.cs.unm.edu/$\sim$steveah/steve\_diss.pdf.

\bibitem{FH96}
Forrest, S., Hofmeyr, S.A.:
\newblock A {S}ense of {S}elf for {U}nix {P}rocesses.
\newblock In: S\&P '96: Proc.~17th {IEEE} Symposium on Security and Privacy,
  IEEE Computer Society Press (2002)  120--128

\bibitem{FHS97}
Forrest, S., Hofmeyr, S.A., Somayaji, A.:
\newblock Computer immunology.
\newblock Communications of the ACM \textbf{40}(10) (1997)  88--96

\end{thebibliography}
