Recent Advances in Intrusion Detection: 11th International Symposium, RAID 2008, Cambridge, MA, USA, September 15-17, 2008, Proceedings(Security and Cryptology)

On behalf of the Program Committee, it is our pleasure to present the p- ceedings of the 11th International Symposium on Recent Advances in Intrusion Detection (RAID 2008), which took place in Cambridge, Massachusetts, USA on September 15–17. The symposium brought together leading researchers and practitioners from academia, government and industry to discuss intrusion detection research and practice. There were six main sessions presenting full-?edged research papers (rootkit prevention, malware detection and prevention, high performance - trusion and evasion, web application testing and evasion, alert correlation and worm detection, and anomaly detection and network tra?c analysis), a session ofpostersonemergingresearchareasandcasestudies,andtwopaneldiscussions (“Government Investments: Successes, Failures and the Future” and “Life after Antivirus - What Does the Future Hold?”). The RAID 2008 Program Committee received 80 paper submissions from all over the world. All submissions were carefully reviewed by at least three independent reviewers on the basis of space, topic, technical assessment, and overallbalance.FinalselectiontookplaceattheProgramCommitteemeetingon May 23rd in Cambridge, MA. Twenty papers were selected for presentation and publication in the conference proceedings, and four papers were recommended for resubmission as poster presentations. As a new feature this year, the symposium accepted submissions for poster presentations,whichhavebeen publishedas extendedabstracts,reportingear- stageresearch,demonstrationofapplications,orcasestudies.Thirty-nineposters were submitted for a numerical review by an independent, three-person s- committee of the Program Committee based on novelty, description, and ev- uation. The subcommittee chose to recommend the acceptance of 16 of these posters for presentation and publication.

Table of Contents:
Recent Advances in Intrusion Detection.- Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing.- Countering Persistent Kernel Rootkits through Systematic Hook Discovery.- Malware Detection and Prevention.- Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections.- A First Step towards Live Botmaster Traceback.- A Layered Architecture for Detecting Malicious Behaviors.- A Study of the Packer Problem and Its Solutions.- High Performance Intrusion Detection and Evasion.- Gnort: High Performance Network Intrusion Detection Using Graphics Processors.- Predicting the Resource Consumption of Network Intrusion Detection Systems.- High-Speed Matching of Vulnerability Signatures.- Web Application Testing and Evasion.- Swarm Attacks against Network-Level Emulation/Analysis.- Leveraging User Interactions for In-Depth Testing of Web Applications.- Model-Based Covert Timing Channels: Automated Modeling and Evasion.- Alert Correlation and Worm Detection.- Optimal Cost, Collaborative, and Distributed Response to Zero-Day Worms - A Control Theoretic Approach.- On the Limits of Payload-Oblivious Network Attack Detection.- Determining Placement of Intrusion Detectors for a Distributed Application through Bayesian Network Modeling.- A Multi-Sensor Model to Improve Automated Attack Detection.- Anomaly Detection and Network Traffic Analysis.- Monitoring SIP Traffic Using Support Vector Machines.- The Effect of Clock Resolution on Keystroke Dynamics.- A Comparative Evaluation of Anomaly Detectors under Portscan Attacks.- Advanced Network Fingerprinting.- Posters.- On Evaluation of Response Cost for Intrusion Response Systems.- WebIDS: A Cooperative Bayesian Anomaly-Based Intrusion Detection System for Web Applications (Extended Abstract).- Evading Anomaly Detection through Variance Injection Attacks on PCA.- Anticipating Hidden Text Salting in Emails.- Improving Anomaly Detection Error Rate by Collective Trust Modeling.- Database Intrusion Detection and Response.- An Empirical Approach to Identify Information Misuse by Insiders (Extended Abstract).- Page-Based Anomaly Detection in Large Scale Web Clusters Using Adaptive MapReduce (Extended Abstract).- Automating the Analysis of Honeypot Data (Extended Abstract).- Anomaly and Specification Based Cognitive Approach for Mission-Level Detection and Response.- Monitoring the Execution of Third-Party Software on Mobile Devices.- Streaming Estimation of Information-Theoretic Metrics for Anomaly Detection (Extended Abstract).- Bots Behaviors vs. Human Behaviors on Large-Scale Communication Networks (Extended Abstract).- Anomalous Taint Detection.- Deep Packet Inspection Using Message Passing Networks.- System Call API Obfuscation (Extended Abstract).