[Apologies for multiple copies of this announcement]

CALL FOR PARTICIPATION

RAID 2004 "Intrusion Detection and Society" Seventh International Symposium on Recent Advances in Intrusion Detection

Sponsored by SAP and France Telecom

Institut Eurecom, Sophia-Antipolis, French Riviera, France September 15-17, 2004 http://raid04.eurecom.fr RAID 2004 will be collocated with ESORICS 2004

============================================================================== IMPORTANT NOTICE: special hotel rates have been negotiated, but the deadline for some hotels is June 30. Please check the hotel information at: http://raid04.eurecom.fr/Hotels.htm ==============================================================================

******************************************* EARLY REGISTRATION DEADLINE: July 20, 2004 *******************************************

The RAID symposium brings together leading researchers and practitioners from academia, government, and industry to discuss intrusion detection technologies and issues from research and commercial perspectives.

This year's program features a single technical track with 14 full papers and 2 practical experience reports selected from almost 120 submissions. It also includes invited speakers, a poster session as well as an abstracts' session.

The abstracts' session offers attendees the opportunity to present preliminary research results or summaries of work published elsewhere. Poster presentations of similar research results are also possible on Wednesday evening. Abstract submissions from people not presenting posters are also welcome. Submissions to either poster or abstract session should be sent to dacier@eurecom.fr. For details see http://raid04.eurecom.fr/ .

PRELIMINARY PROGRAM -------------------

Wednesday, September 15th =========================

09.00 Registration opens

12.30 Lunch

14.00 - 14.15 Welcome

14.15 - 15.15 Invited Talk

Bruce Schneier, Counterpane Internet Security, CA, USA

15.15 - 15.45 Coffee break

15.45 - 16.45 Modelling process behaviour - Chair: Alfonso Valdes, (SRI International, USA)

Automatic Extraction of Accurate Application-Specific Sandboxing Policy, Lap-chung Lam and Tzi-cker Chiueh, Rether Networks Inc., Centereach N.Y., USA

Context Sensitive Anomaly Monitoring of Process Control Flow to Detect Mimicry Attacks and Impossible Paths, Haizhi Xu, Wenliang Du, and Steve J. Chapin, Systems Assurance Institute, Syracuse University, USA

16.45 - 17.00 Break

17.00 - 18.00 Abstract session

18.00 - Poster session

Thursday, September 16th ========================

09.00 - 10.30 Detecting Worms and Viruses - Chair: John McHugh (CMU/SEI CERT, USA)

HoneyStat: Local Worm Detection Using Honeypots, David Dagon, Xinzhou Qin, Guofei Gu, Julian Grizzard, John Levine, Wenke Lee, and Henry Owen, Georgia Institute of Technology, USA

Fast Detection of Scanning Worm Infections, Jaeyeon Jung (1), Stuart E. Schechter (2), and Arthur W. Berger (1), (1) MIT CSAIL, USA (2) Harvard DEAS, USA.

Detecting Unknown Massive Mailing Viruses Using Proactive Methods Ruiqi Hu and Aloysius K. Mok, Dept of Computer Sciences, University of Texas at Austin, USA

10.30 - 11.00 Coffee break

11.00 - 12.30 Attack and Alert Analysis - Chair: Diego Zamboni (IBM Research, Switzerland)

Using Adaptive Alert Classification to Reduce False Positives in Intrusion Detection, Tadeusz Pietraszek, IBM Zürich Research Laboratory, Switzerland.

Attack Analysis and Detection for Ad Hoc Routing Protocols Yi-an Huang, Wenke Lee, College of Computing, Georgia Institute of Technology, USA.

On the Design and Use of Internet Sinks for Network Abuse Monitoring Vinod Yegneswaran (1), Paul Barford (1), Dave Plonka (2), (1) Dept of Computer Science, University of Wisconsin, Madison, USA, (2) Dept of Information Technology, University of Wisconsin, Madison, USA

12.30 - 14.00 Lunch

14.00 - 15.00 Invited Talk: TBD

15.00 - 15.30 Coffee break

15.30 - 16.30 Practical Experience - Chair: Hakan Kvarnstrom (TeliaSonera R&D, Sweden)

Monitoring IDS Background Noise Using EWMA Control Charts and Alert Information Jouni Viinikka and Herve Debar, France Telecom R&D, Caen, France

Experience with a Commercial Deception System, Brian Hernacki, Jeremy Bennett, Thomas Lofgren, Symantec Corporation, Redwood City, USA

16.30 - 17.30 Poster session

Friday, September 17th ======================

09.00 - 10.30 Anomaly Detection - Chair: Christopher Kruegel, (Technical University of Vienna, Austria)

Anomalous Payload-based Network Intrusion Detection Ke Wang Salvatore J. Stolfo, Computer Science Dept, Columbia University, USA

Anomaly Detection Using Layered Networks Based on Eigen Co-occurrence Matrix Mizuki Oka (1), Yoshihiro Oyama (2,3), Hirotake Abe (1), and Kazuhiko Kato (1,3), (1) University of Tsukuba, Japan, (2) University of Tokyo, Japan, (3) Japan Science and Technology Cooperation, Japan

Seurat: A Pointillist Approach to Anomaly Detection Yinglian Xie (1), Hyang-Ah Kim (1), David R. O'Hallaron (1,2) Michael K. Reiter (1,2), and Hui Zhang (1,2), (1) Dept of Computer Science, Carnegie-Mellon University, USA (2) Dept of Electrical and Computer Engineering, Carnegie-Mellon University, USA

10.30 - 11.00 Coffee Break

11.00 - 12.30 Formal Analysis for Intrusion Detection - Chair: Wenke Lee (Georgia Tech, USA)

Detection of Interactive Stepping Stones with Maximum Delay Bound: Algorithms and Confidence Bounds Avrim Blum, Dawn Song, Shobha Venkataraman Carnegie Mellon University, USA.

Formal Reasoning about Intrusion Detection Systems Tao Song (1), Calvin Ko (2), Jim Alves-Foss (3), Cui Zhang (4), and Karl Levitt (1), (1) Computer Security Laboratory, University of California, Davis, USA, (2) NAI LAbs, Network Associates Inc., Santa Clara, CA, USA, (3) Center for Secure and Dependable Systems, University of Idaho, USA (4) Computer Science Dept, California State University, Sacramento, USA.

RheoStat : Real-time Risk Management Ashish Gehani and Gershon Kedem, Dept of Computer Science, Duke University, USA

12.30 - 12.45 Concluding remarks

12.45 - 14.00 Lunch

ORGANIZING COMMITTEE --------------------

General Chair: Refik Molva refik.molva@eurecom.fr

Program Chairs: Erland Jonsson erland.jonsson@ce.chalmers.se Alfonso Valdes valdes@sdl.sri.com

Publication Chair: Magnus Almgren almgren@ce.chalmers.se

Publicity Chair: Yves Roudier Yves.Roudier@eurecom.fr

Sponsor Chair: Marc Dacier marc.dacier@eurecom.fr

PROGRAM COMMITTEE -----------------

Tatsuya Baba (NTT Data, Japan) Lee Badger (DARPA, USA) Sungdeok Cha (KAIST, Korea) Steven Cheung (SRI International, USA) Herve Debar (France Telecom R&D, France) Simone Fischer-Hubner (Karlstad University, Sweden) Steven Furnell (University of Plymouth, UK) Bill Hutchinson (Edith Cowan University, Australia) Dogan Kesdogan (RWTH Aachen, Germany) Chris Kruegel (Technical University of Vienna, Austria) Hakan Kvarnstrom (TeliaSonera R&D, Sweden) Wenke Lee (Georgia Tech, USA) Douglas Maughan (DHS HSARPA, USA) Roy Maxion (Carnegie Mellon University, USA) John McHugh (CMU/SEI CERT, USA) Ludovic Me (Supelec, France) George Mohay (Queensland University of Technology, Australia) Vern Paxson (ICSI and LBNL, USA) Giovanni Vigna (UCSB, USA) Andreas Wespi (IBM Research, Switzerland) Felix Wu (UC Davis, USA) Diego Zamboni (IBM Research, Switzerland)

STEERING COMMITTEE ------------------

Chair: Marc Dacier (Eurecom, France)

Herve Debar (France Telecom R&D, France) Deborah Frincke (University of Idaho, USA) Huang Ming-Yuh (The Boeing Company, USA) Wenke Lee (Georgia Institute of Technology, USA) Ludovic Me (Supelec, France) S. Felix Wu (UC Davis, USA) Andreas Wespi (IBM Research, Switzerland) Giovanni Vigna (UCSB, USA)

VENUE / TRAVEL --------------

RAID 2004 will be held on the French Riviera coast, about 20 km West of Nice and 15 km Northeast of Cannes. The conference will take place at Institut Eurecom / CICA, in the Sophia Antipolis science park, which can easily be reached thanks to the nearby Nice international airport. For more information, refer to: http://raid04.eurecom.fr/visitor_information.html

IMPORTANT DATES ---------------

Deadlines for special rates for hotels : see http://raid04.eurecom.fr/Hotels.htm Deadline for early registration : July 20, 2004 Deadline for abstract/poster submission : August 30, 2004 (contact: Marc Dacier Marc.Dacier@eurecom.fr) RAID conference dates : September 15-17, 2004