This document is the revised version of the Intrusion Detection Systems page managed by our former colleague Michael Sobirey. Since Michael left our team in 1999 and now is working for a Security Consulting Company, he doesnt have time to update this older page.

Remarks:

• This page doesnt contain any (file system based) integrity checkers and honeypots.
• Comments, corrections and supplements are welcome. Please contact Michael Meier.
• Currently there are 132 Intrusion Detection and Response Systems listed on this page.
• Last update: December 8 2004

AAFID (Autonomous Agents for Intrusion Detection)

• Spafford, E. H.; Zamboni, D.: Intrusion detection using autonomous agents, in Computer Networks, Volume 34, Issue 4, October 2000, 547-570
  Elsevier
• Crosbie, M.; Spafford, E. H.: Applying genetic programming to intrusion detection, Proc. of the 1995 AAAI Fall Symposium on Genetic Programming, Nov. 1995
  ResearchIndex/CiteSeer
• Crosbie, M.; Spafford, E. H.: Defending a Computer System using Autonomous Agents, Proc. of the 18th National Information Systems Security Conference, Baltimore, MD, Oct. 1995, 549 - 558

AAIRS (Adaptive Agent-based Intrusion Response System)

• Texas A&M University
• United States Military Academy

Abacus Project

ACME! (Advanced Counter-measure Evironment)

ADS (Attack Detection System)

• Kantzavelou, I.; Katsikas, S. K.: An attack detection system for secure computer systems - Outline of the solution, in Yngström, L.; Carlsen, J. (eds.): Information Security in Research and Business, Proc. of the IFIP TC11 13th International Information Security Conference (SEC97), Copenhagen, Denmark, May 1997, Chapman & Hall, London, 123 - 135
• Kantzavelou, I.; Patel, A.: An attack detection system for secure computer systems - Design of ADS, in Katsikas, S. K.; Gritzalis, D. (eds.) Information Systems Security, Proc. of the IFIP TC11 12th International Information Security Conference (SEC96), May 1996, Samos, Greece, Chapman & Hall, London, 1996, 1 - 16

AFJ (Anzen Flight Jacket)

AHA! IDS (Adaptive Hierarchical Agent-based Intrusion Detection System)

• Texas A&M University
• United States Military Academy

AID (Adaptive Intrusion Detection system)

AIMS (Automated Intrusion Monitoring System)

ALERT-PLUS/ Protect 2000

ALVA (Audit Log Viewer and Analyzer)

APA (Automated Penetration Analysis tool)

ARIA (Active Recognition of Invidious Assaults)

ARMD (Adaptable Real-time Misuse Detection)

ARMOR (Adaptive Risk Management, Oberservation, and Response System)

ASAX (Advanced Security audit trail Analyzer on uniX)

• http://www.info.fundp.ac.be/~amo/publications.html
• http://www.ja.net/CERT/Software/asax/

ASIM (Automated Security Incident Measurement)

AudES (Audit based Expert System)

BlackICE

BLARE

• Jacob Zimmermann, Ludovic Mé, Christophe Bidan. Experimenting with a Policy-Based HIDS Based on an Information Flow Control Model. In proceedings of the Annual Computer Security Applications Conference (ACSAC). December 2003.
• Jacob Zimmermann, Ludovic Mé, Christophe Bidan. An Improved Reference Flow Control Model for Policy-Based Intrusion Detection. In proceedings of the 8th European Symposium on Research in Computer Security (ESORICS). October 2003.
• Jacob Zimmermann, Ludovic Mé, Christophe Bidan. Introducing reference flow control for intrusion detection at the OS level. In proceedings of the 5th International Symposium on the Recent Advances in Intrusion Detection (RAID). Springer Verlag, LNCS 2516, October 2002.

BlueBox

Bro

CaptIO

Centrax

CERN-NSM (Network Security Monitor)

Cisco Secure IDS

CMDS (Computer Misuse Detection System)

• Proctor, P. E.: Computer Misuse Detection System (CMDST) Concepts, SAIC Technical Paper, 1996
  publications.saic.com
• Proctor, P. E.: Audit reduction and misuse detection in heterogeneous environments: Framework and application, in Proc. of the 10th Annual Computer Security Applications Conference, Orlando, FL, Dec. 1994, 117 - 125

ComputerWatch

• http://www.att.com/press/1192/921116.fsa.html
• http://www.att.com/press/0293/930202.fsa.html

Corba Immune System

CSM (Cooperating Security Managers)

• Texas A&M University, College Station, Texas
• US Air Force Academy, Colorado Springs, Colorado

• White, G. B.; Pooch, U.: Cooperating Security Managers: distributed intrusion detection systems, Computers & Security, Vol. 15, No. 5, 1996, 441 - 450
• White, G. B.; Fisch, E. A.; Pooch, U. W.: Cooperating Security Managers: A Peer-based Intrusion Detection System, IEEE Network Magazine, IEEE Press, Jan./Feb. 1996, 20 - 23

CyberCop Monitor

CyberTrace

CyberwallPLUS

DARE (Distributed Assessment and REsponse)

DECinspect Intrusion Detector

Defense Worx Network Intrusion Detection System

DEMIDS - Detection of MIsuse in Database Systems

DERBI (Diagnosis, Explanation and Recovery from computer Break-Ins)

DIDS (Distributed Intrusion Detection System)

• Snapp, S. R.; Smaha, S. E.; Grance, T.; Teal, D. M.: The DIDS (Distributed Intrusion Detection System) Prototype, USENIX, Summer 1992 Technical Conference San Antonio, USA, June 1992, Berkley, USENIX Association, 227 - 233
• Snapp, S. R.; Brentano, J.; Dias, G. V.; Goan, T. L.; Heberlein, L. T.; Ho, C.; Levitt, K. N.; Mukherjee, B.; Smaha, S. E.; Grance, T.; Teal, D. M.; Mansur, D.: DIDS (Distributed Intrusion Detection System) - Motivation, architecture and an early prototype, Proc. of the 14th National Computer Security Conference, Washington, D. C., Oct. 1991, 167 - 176
  ResearchIndex/CiteSeer
• Brentano, J.; Snapp, S. R.; Dias, G. V.; Goan, T. L.; Heberlein, L. T.; Ho, C. L.; Levitt, K. N.; Mukherjee, B.; Smaha, S. E.: An Architecture for a Distributed Intrusion Detection System, Proc. of the 14th DoE Computer Security Group Conference, May 1991, 25 - 45
• Snapp, S. R.; Brentano, J.; Dias, G. V.; Goan, T. L.; Grance, T., Heberlein, L. T.; Ho, C.-L.; Levitt, K. N.; Mukherjee, B.; Mansur, D. L.; Pon, K. L.; Smaha, S. E.: A System for Distributed Intrusion Detection, Proc. of the COMPCON, Feb./March 1991, San Francisco, CA, 170 - 176

Discovery

DPEM (Distributed Program Execution Monitor)

• Ko, C.: Execution Monitoring of Security-Critical Programs in a Distributed System: A Specification-Based Approach, Ph.D. Thesis, U.C. Davis, August 1996.
• Ko, C.; Levitt, K.: Automated Detection of Vulnerabilities in Privileged Programs by Execution Monitoring, in Proceedings of the 10th Annual Computer Security Applications Conference, Orlando, FL, IEEE Computer Society Press, 1994, 134 - 144
  ResearchIndex/CiteSeer

Dragon

DRISC (Detect and Recover Intrusion using System Critically)

EASEL

EMERALD (Event Monitoring Enabling Responses to Anomalous Live Disturbances)

• Porras, A. Ph.; Neumann, P. G.: EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances, in Proc. of the National Information Systems Security Conference, 1997
• Neumann, P. G.; Porras, A. Ph.: Experience with EMERALD to Date, in Proc. of First USENIX Workshop on Intrusion Detection and Network Monitoring, Santa Clara, California, April, 1999, 73 - 80
  ResearchIndex/CiteSeer

ENTERCEPT

ERIDS (External Routing Intrusion Detection System)

ESSENSE

eTrust Intrusion Detection

FW-1 specific Network Intrusion Detector

GASSATA (Genetic Algorithms for Simplified Security Audit Trail Analysis)

• Me, L.: Genetic Algorithms, a Biologically Inspired Approach for Security Audit Trails Analysis, short paper, presented at the 1996 IEEE Symposium on Security and Privacy, Oakland, CA, May 1996
• Me, L.: Security audit trail analysis using genetic algorithms, in Proc. of the 12th International Conference on Computer Safety, Reliability and Security, Poznan, Poland, Oct. 1993, 329 - 340

GnG (GASSATA new Generation)

• Eric Totel, Bernard Vivinis and Ludovic Mé. A Language Driven Intrusion Detection System for Events and Alerts Correlation. Proceedings ot the 19th IFIP International Information Security Conference.Kluwer Academic, August 2004.

GrIDS (Graph-based Intrusion Detection System)

HAXOR

Haystack

HP IDS 9000

Hummer

Hyperview

• Debar, H.; Dorizzi, B.: An application of a recurrent network to an intrusion detection system, in Proc. of the International Joint Conference on Neural Networks, Baltimore, MD, June 1992, 478 - 483
• Debar, H.; Becker, M.; Siboni D.: A neural network component for an intrusion detection system, in Proc. of the IEEE Symposium on Research in Security and Privacy, Oakland, CA, May 1992, 1 - 11

IDA(1) (Intrusion Detection Alert)

IDA(2) (Intrusion Detection and Avoidance system)

• Sobirey, M.; Fischer-Hübner, S.; Rannenberg, K.: Pseudonymous Audit for Privacy Enhanced Intrusion Detection, in Yngström, L.; Carlsen, J. (eds.): Information Security in Research and Business, Proc. of the IFIP TC11 13th International Information Security Conference (SEC97), Copenhagen, Denmark, May 1997, Chapman & Hall, London, 151 - 163
• Fischer-Hübner, S.; Brunnstein, K.: Combining verified and adaptive system components towards more secure computer architectures, in Rosenberg, J.; Keedy, J. L. (eds.): Proc. of the International Workshop on Computer Architectures to Support Security and Persistence of Information, Bremen, May 1990, 1 - 7

IDA(3) (Intrusion Detection Agents Systems)

• Asaka, M.; Okazawa, S; Taguchi, A.; Goto, S.: A Method of Tracing Intruders by Use of Mobile Agent, in Proceedings of the 9th Annual Internetworking Conference (INET`99), San Jose, California, June 1999
  ResearchIndex/CiteSeer
• Asaka, M.; Taguchi, A.; Goto, S.: The Implementation of IDA: An Intrusion Detection Agent System, in Proceedings of the 11th FIRST Conference 1999, Brisbane, Australia, June 1999
  ResearchIndex/CiteSeer

IDEAS (Intrusion Detection & Alerting System)

IDES (Intrusion Detection Expert System)

• Lunt, T.; Tamaru, A.; Gilham, F.; Jagannathan, R.; Jalali, C.; Neumann, P. G.; Javitz, H. S.; Valdes, A.; Garvey, T. D.: A real time Intrusion Detection Expert System (IDES) - Final Report, SRI International, Menlo Park, CA, Feb. 1992
• Javitz, H. S.; Valdes, A.: The SRI IDES statistical anomaly detector, in Proc. of the Symposium on Research in Security and Privacy, Oakland, CA, May 1991, 316 - 326
• Lunt, T. F.; Tamaru, A.; Gilham, F.; Jagannathan, R.; Neumann, P. G.; Jalali, C.: IDES: A Progress Report, in Proc. of the 6th Annual Computer Security Applications Conference, Dec. 1990, 273 - 285
• Lunt, T. F.: IDES: An Intelligent System for Detecting Intruders, in Proc. of the Symposium: Computer Security, Threat and Countermeasures, Rom, Italy, Nov. 1990, ?? - ??
• Lunt, T. F.; Jagannathan, R.: A Prototype Real-Time Intrusion Detection Expert System, in Proc. of the Symposium on Security and Privacy, New York, NY, Apr. 1988, 59 - 66
• Lunt, T. F.: Knowledge based Intrusion Detection, in Proc. of the Annual AI Systems in Government Conference, Washington, D. C., March 1989, 102 - 107
• Denning, D. E.; Neumann, P. G.: Requirements and Model for IDES - A Real-Time Intrusion Detection Expert System, Technical Report, Computer Science Laboratory, SRI International, Menlo Park, CA, 1985

IDIOT (Intrusion Detection In Our Time)

• Crosbie, M.; Dole, B.; Ellis, T.; Krsul, I.; Spafford, E.: IDIOT - Users Guide, Technical Report TR-96-050, Purdue University, COAST Laboratory, Sept. 1996
  ResearchIndex/CiteSeer

ID-Trak

INTOUCH INSA - Network Security Agent

Inspect

Intruder Alert

ISM (Internetwork Security Monitor)

ISOA (Information Security Officers Assistent)

• Winkler, J. R.; Landry, L. C.: Intrusion and anomaly detection, ISOA update, in Proc. of the 15th National Computer Security Conference, Baltimore, Oct. 1992, 272 - 281
• Winkler, J. R.: A UNIX Prototype for Intrusion and Anomaly Detection in Secure Networks, in Proc. of the 13th National Computer Security Conference, Washington, D. C., Oct. 1990, 115 - 124
• Winkler, J. R.; Page, W. J.: Intrusion and Anomyly Detection in Trusted Systems, in Proc. of the 5th Anual Computer Security Applications Conference, Tucson, AZ, 1989, 39 - 45

IP360

JAM

JiNao

KSE (Kane Security Enterprise)

KSM (Kane Security Monitor)

LANguard

M-ICE (Modular Intrusion Detection and Countermeasure Environment)

MADAM ID (Mining Audit Data for Automated Models for Intrusion Detection)

MAIDS (Mobile Agent Intrusion Detection System)

• Helmer, G.G.; Wong, J. S. K.; Honavar, V.; Miller, L.: Intelligent agents for intrusion detection, in Proceedings, IEEE Information Technology Conference, Syracuse, NY, September 1998, 121-124
  ResearchIndex/CiteSeer
• Helmer, G.; Wong, J.; Honavar, V.; Miller, L.: Lightweight agents for intrusion detection, submitted to Journal of Systems and Software, 2000,
  ResearchIndex/CiteSeer

ManHunt

MIDAS(1) (Multics Intrusion Detection and Alerting System)

• National Computer Security Center, Ft. Meade, Maryland
• SRI International, Menlo Park, California

MIDAS(2) (Mobile Intrusion Detection and Assessment System)

MIDS (Master Intrusion Detection System)

NADIR (Network Anomaly Detector and Intrusion Reporter)

• Hochberg, J.; Jackson, K.; Stallings, C.; McClary, J.; DuBois, D.; Ford, J.: NADIR: An automated system for detecting network intrusions and misuse, Computers and Security 12(1993)3, May, 253 - 248
• Jackson, K. A.: NADIR: A Prototype System for Detecting Network and File System Abuse, in Proc. of the 7th European Conference on Information Systems, Nov. 1992
• Jackson, K.; DuBois, D. H.; Stallings, C. A.: An expert system application for network intrusion detection, in Proc. of the 14th National Computer Security Conference, Washington, D. C., Oct. 1991, 215 - 225

NAURS (Network Auditing Usage Reporting System)

• The following two references are cited in: Lunt, T. F.: Automated audit trail analysis and intrusion detection: A survey, in Proc. of the 11th National Computer Security Conference, Baltimore, MD, Oct. 1988, ResearchIndex/CiteSeer
• Neumann, P. G.: Audit trail analysis and usage data collection and processing, Part 1. Computer Science Laboratory, SRI International, Jan. 1985
• Neumann, P. G.; Ostapik, F.: Audit Trail Analysis and Usage Data Collection and Processing, Part 2, Computer Science Laboratory, SRI International, May 1987

NEDAA (Network Exploitation Detection Analyst Assistant)

• http://www.arlut.utexas.edu/~ciadswww
• http://www.arlut.utexas.edu/news/NEDAA.html

NetDetect

NetFacade

NetProwler

NetStalker

NetSTAT (Network-based State Transition Analysis Tool)

• Vigna, G.; Kemmerer, R.A.: NetSTAT: A Networkbased Intrusion Detection System, in Journal of Computer Security, Vol. 7, No. 1,1999, 37-71
  ResearchIndex/CiteSeer
• Vigna, G.; Kemmerer, R.A.: NetSTAT: A Network-based Intrusion Detection Approach, in Proceedings of the 14th Annual Computer Security Conference, Scottsdale, Arizona, December 1998
  ResearchIndex/CiteSeer
• Vigna, G.; Eckmann, S. T.; Kemmerer, R. A.: The STAT Tool Suite, in Proceedings of DISCEX 2000, Hilton Head Island, January 2000, IEEE Press
  ResearchIndex/CiteSeer

Network Radar

NFR (Network Flight Recorder)

NICE (?)

• Heady, R.; Luger, G.; Macabe, A.; Servilla, M.; Sturtevant, J.: A prototype implementation of a network-level intrusion detection system, Technical Report CS91-11, Department of Computer Science, University of New Mexico, May 1991
• Heady, R.; Luger, G.; Macabe, A.; Servilla, M.: The architecture of a network level intrusion detection system, Technical Report CS90-20, Department of Computer Science, University of New Mexico, Aug. 1990

NID (Network Intrusion Detector)

NIDAR

NIDES (Next-generation Intrusion Detection Expert System)

• Anderson, D.; Lunt, T. F.; Javitz, H.; Tamaru, A.; Valdes, A.: Detecting Unusaul Program Behavior Using the Stastistical Component of the Next-generation Intrusion Detection Expert System (NIDES), SRI-CSL-95-06, SRI International, Menlo Park, CA, May 1995
• Anderson, D.; Frivold, Th.; Valdes, A.: Next-generation Intrusion Detection Expert System (NIDES): A Summary, SRI-CSL-95-07, SRI International, Menlo Park, CA, May 1995
• Anderson, D.; Frivold, T.; Tamaru, A.; Valdes, A.: Next-generation Intrusion Detection Expert System (NIDES): Software Users Manual, 1994
  ResearchIndex/CiteSeer

NIDX (Network Intrusion Detection eXpert system)

• Bauer, D. S.; Koblentz, M. E.: NIDX - An expert system for real-time network intrusion detection, in Proc. of the IEEE Computer Networking Symposium, New York, NY, April 1988, 98 - 106
• Bauer, D. S.; Koblentz, M. E.: NIDX -- a real-time intrusion detection expert system, in Proceedings of the Summer 1988 USENIX Conference, 1988, 261-273

NOCOL (Network Operation Center On-Line) a.k.a. SNIPS (System and Network Integrated Polling Software)

NSM (Network Security Monitor)

• Heberlein, L. Todd:Network Security Monitor: Final Report,University of California at Davis, Computer Science Department, Computer Security Laboratory, 1995,http://seclab.cs.ucdavis.edu/papers/NSM-final.pdf
• Heberlein, L. T.; Levitt, K. N.; Mukherjee, B.: A method to detect intrusive activity in a networked environment, in Proc. of the 14th National Computer Security Conference, Washington D. C., Oct. 1991, 362 - 371
• Heberlein, L. T.; Dias, G. V.; Levitt, K. N.; Mukherjee, B.; Wood, J.: Networks Attacks and an Ethernet-based Network Security Monitor, in Proc. of the 13th DOE Security Group Conference, Augusta, GA, May 1990
• Heberlein, L. T.; Dias, G. V.; Levitt, K. N.; Mukherjee, B.; Wood, J.; Wolber, D.: A Network Security Monitor, in Proc. of the IEEE Symposium on Research in Security and Privacy, Oakland, CA, May 1990, 296 - 304

NSTAT

• Vigna, G.; Eckmann, S. T.; Kemmerer, R. A.: The STAT Tool Suite, in Proceedings of DISCEX 2000, Hilton Head Island, IEEE Press, January 2000
  ResearchIndex/CiteSeer
• Kemmerer, R. A.: NSTAT: A Model-based Real-time Network Intrusion Detection System, Computer Science Dep., University of California Santa Barbara, Technical Report TRCS97-18, November 1997
  ResearchIndex/CiteSeer

Openview Node Sentry

• http://www.psl-dist.co.uk/Downloads/NodeSentry.pdf
• http://www.cisco.com/warp/public/756/partnership/hp/solutions_brief/sentry_sb.html

Packet Monster

PDAT (Protocol Data Analysis Tool)

POLYCENTER Security Intrusion Detector

PRéCis

Prelude

ProxyStalker for NT

Quicksand

RAD (Registry Anomaly Detection)

RealSecure

RETISS (REal-TIme expert Security System)

RID (Reactive Intrusion Detection for Gauntlet Firewalls)

SecureNet PRO

SecureSwitch

SHADOW (Secondary Heuristic Analysis for Defensive Online Warfare)

SIDS (Statistical Intrusion Detection System)

Snort

SnortNet

SPARTA (Security Policy Adaptation Reinforced Through Agents)

Stake Out

Stalker

STIDE (Sequence TIme-Delay Embedding)

TIM (Time-based Inductive Machine) based IDS

• Teng, H. S.; Chen, K.; Lu, S. C.: Security audit trail analysis using inductively generated predictive rules, in Proc. of the 6th Conference on Artificial Intelligence Applications, Santa Barbara, CA, May 1990, 24-29
• Teng, H. S.; Chen, K.; Lu, S. C.: Adaptive real-time anomaly detection using inductively generated sequential patterns, in Proc. of the IEEE Symposium on Research in Security and Privacy, Oakland, CA, May 1990, 278 - 284

Tivoli Cross-Site for Security

TRW (system name unknown)

T-sight

UNICORN (Unicos Realtime NADIR)

• Christoph, G. G.; Jackson, K. A.; Neumann, M. C.; Siciliano, Ch. L. B.; Simmonds, D. D.; Stallings, C. A.; Thompson, J. L.: UNICORN: Misuse Detection for UNICOS, in Proc. of the Supercomputing 95, San Diego, CA, 1995
  supercomp.org
• Jackson, K.; Neumann, M.; Simmonds, D.; Stallings, C.; Thompson, J.; Christoph, G.: An Automated Computer Misuse Detection System for UNICOS, in Proc. of the Cray Users Group Conference, Oct. 1994

USTAT (Unix State Transition Analysis Tool)

• Vigna, G.; Eckmann, S. T.; Kemmerer, R. A.: The STAT Tool Suite, in Proceedings of DISCEX 2000, Hilton Head Island, January 2000, IEEE Press
  ResearchIndex/CiteSeer
• Ilgun, K.; Kemmerer, R. A.; Porras, Ph. A.: State transition analysis: A rule-based intrusion detection approach, IEEE Transactions on Software Engineering 21(1995)3, 181 - 199
  ResearchIndex/CiteSeer
• Ilgun, K.: USTAT: A Real-time Intrusion Detection System for UNIX, in Proc. of the IEEE Computer Society Symposium on Research in Security and Privacy, May 1993, Oakland, CA, 16 - 28
  ResearchIndex/CiteSeer

VisionIDS

WebStalker Pro

W&S (Wisdom & Sense)

• Los Alamos National Laboratory, Los Alamos, New Mexico
• Oak Ridge National Laboratory, Oak Ridge, Tennessee

• Liepins, G. E.; Vaccaro, H. S.: Intrusion Detection: Its role and validation, Computers & Security 11/1992, 347 - 355
• Liepins, G. E.; Vaccaro, H. S.: Anomaly detection purpose and framework, in Proc. of the 12th National Computer Security Conference, Baltimore, MD, Oct. 1989, 495 - 504
• Vaccaro, H. S.; Liepins, G. E.: Detection of anomalous computer session activity, in Proc. of the Symposium on Research in Security and Privacy, Oakland, CA, May 1989, 280 - 289