[1] M. Almgren and U. Lindqvist. Application-Integrated
Data Collection for Security Monitoring. In Proceedings
of Recent Advances in Intrusion Detection (RAID),
LNCS, pages 22–36, Davis,CA, October 2001. Springer.
[2] Apache 2.0 Documentation, 2002.
http://www.apache.org/.
[3] D. Barbara, R. Goel, and S. Jajodia. Mining Malicious
Data Corruption with Hidden Markov Models. In 16th
Annual IFIP WG 11.3 Working Conference on Data
and Application Security, Cambridge, England, July
2002.
[4] Patrick Billingsley. Probability and Measure.
Wiley-Interscience, 3 edition, April 1995.
[5] CERT/CC. “Code Red Worm” Exploiting Buffer
Overflow In IIS Indexing Service DLL. Advisory
CA-2001-19, July 2001.
[6] CGI Security Homepage.
http://www.cgisecurity.com/, 2002.
[7] K. Coar and D. Robinson. The WWW Common
Gateway Interface, Version 1.1. Internet Draft, June
1999.
[8] csSearch. http://www.cgiscript.net/.
[9] Cyberstrider WebWho. http://www.webwho.co.uk/.
[10] D.E. Denning. An Intrusion Detection Model. IEEE
Transactions on Software Engineering, 13(2):222–232,
February 1987.
[11] R. Fielding et al. Hypertext Transfer Protocol –
HTTP/1.1. RFC 2616, June 1999.
[12] S. Forrest. A Sense of Self for UNIX Processes. In
Proceedings of the IEEE Symposium on Security and
Privacy, pages 120–128, Oakland, CA, May 1996.
[13] A.K. Ghosh, J. Wanken, and F. Charron. Detecting
Anomalous and Unknown Intrusions Against
Programs. In Proceedings of the Annual Computer
Security Applications Conference (ACSAC’98), pages
259–267, Scottsdale, AZ, December 1998.
[14] K. Ilgun, R.A. Kemmerer, and P.A. Porras. State
Transition Analysis: A Rule-Based Intrusion Detection
System. IEEE Transactions on Software Engineering,
21(3):181–199, March 1995.
[15] IMP Webmail Client. http://www.horde.org/imp/.
[16] H. S. Javitz and A. Valdes. The SRI IDES Statistical
Anomaly Detector. In Proceedings of the IEEE
Symposium on Security and Privacy, May 1991.
[17] C. Ko, M. Ruschitzka, and K. Levitt. Execution
Monitoring of Security-Critical Programs in
Distributed Systems: A Specification-based Approach.
In Proceedings of the 1997 IEEE Symposium on
Security and Privacy, pages 175–187, May 1997.
[18] C. Kruegel, T. Toth, and E. Kirda. Service Specific
Anomaly Detection for Network Intrusion Detection.
In Symposium on Applied Computing