References

Cho, S. and S. Cha, 2004. SAD: Web session anomaly detection based on parameter estimation. Comput. Security, 23: 312-319.
CrossRef  |  

Damashek, M., 1995. Gauging similarity with n-grams: Language independent categorization of text. Science, 267: 843-848.
CrossRef  |  PubMed  |  

Fawcett, T., 2006. An introduction to ROC analysis. Pattern Recognit. Lett., 27: 861-874.
CrossRef  |  Direct Link  |  

Gordon, L.A., M.P. Loeb, W. Lucyshyn and R. Richardson, 2005. CSI/FBI computer crime and security survey. Computer Security Institute,

Ingham, K.L. and H. Inoue, 2007. Comparing anomaly detection techniques for HTTP. Proceedings of the 10th International Conference on Recent Advances in Intrusion Detection, September 5-7, 2007, Springer-Verlag, Berlin, pp: 42-62.

Ingham, K.L., 2007. Anomaly detection for HTTP intrusion detection: Algorithm comparisons and the effect of generalization on accuracy. Ph.D. Thesis, University of New Mexico, USA.

Ingham, K.L., A. Somayaji, J. Burge and S. Forrest, 2007. Learning DFA representations of HTTP for protecting web applications. Comput. Networks, 51: 1239-1255.
CrossRef  |  Direct Link  |  

Kruegel, C. and G. Vigna, 2003. Anomaly detection of webbased attacks. Proceedings of the 10th ACM Conference on Computer and Communications Security, October 27-31, 2003, Washington, DC, USA., pp: 251-261.

Kruegel, C., G. Vigna and W. Robertson, 2005. A multi-model approach to the detection of web-based attacks. Comput. Networks, 48: 717-738.
CrossRef  |  Direct Link  |  

Luotonen, A., 1995. The common logfile format. July 1995. http://www.w3.org/Daemon/User/Config/Logging.html.

Maxion, R.A. and R.R. Roberts, 2004. Proper use of ROC curves in intrusion/anomaly detection. Technical Report CS-TR-871, Newcastle University, 2004.

Robertson, W., G. Vigna, C. Kruegel and R.A. Kemmerer, 2006. Using generalization and characterization techniques in the anomaly-based detection of web attacks. Proceedings of the 13th Symposium on Network and Distributed System Security, February 2006, San Diego, CA., pp: 1-15.

Roesch, M., 1999. Snort-lightweight intrusion detection for networks. Proceedings of the 13th LISA Conference on System Administration, November 7-12, 1999, Seattle, Washington, pp: 229-238.

Wang, K. and S.J. Stolfo, 2004. Anomalous payload-based network intrusion detection. Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection, September 15-17, 2004, Sophia Antipolis, France, pp: 203-222.

Wang, K., J.J. Parekh and S.J. Stolfo, 2006. Anagram: A content anomaly detector resistant to mimicry attack. Proceedings of the 9th International Conference on Recent Advances in Intrusion Detection, September 20-22, 2006, Springer-Verlag Berlin, pp: 226-248.