IDS: Detecting network flow anomalies.

[Vinay A. Mahadik <vamahadi@unity.ncsu.edu>]

Archive: http://msgs.securepoint.com/ids
FAQ IDS: http://www.sans.org/newlook/resources/IDFAQ/ID_FAQ.htm
FAQ NIDS: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
HELP: Having problems... email questions to ids-owner@uow.edu.au
NOTE: Remove this section from reply msgs otherwise the msg will bounce.
SPAM: DO NOT send unsolicted mail to this list.
UNSUBSCRIBE: email "unsubscribe ids" to majordomo@uow.edu.au
-----------------------------------------------------------------------------
Hi,

We are investigating the effects/detection of DoS attacks on DiffServ
domains wherein one or more core/edge routers may be compromised. We plan
to adapt NIDES(SRI) and Jinao(MCNC)'s statistical-anomaly
approach for this. 

I would like to know the present state of the art in this area -
statistical detection of network flow anomalies.  

Thanks,
Vinay.

--
Mr. Mahadik, Vinay A.
http://hickory.csc.ncsu.edu