Privacy-Enabled Global Threat Monitoring

Abstract

The history of intrusion detection research gives a nice example of a community in a perpetual race to stay relevant. While we once focused on detecting user account misuse in mainframes, we then moved on to local area network abuse, and then to address the scalability problems in enterprise-wide detection. With the rise of e-commerce in the late 1990s, we intrusion detection developers have had to react to the emergence of script kiddies and Web defacements. Distributed denial-of-service attacks and wide-scale virus propagation soon followed, as did a new term, malware research, to address the growing concern about viruses and self-replicating worms spreading across the Internet at alarming speeds. More recently, we've had to consider the problem of botnets, which can organize and maintain illicit control of thousands of machines for months at a time to spread spam, conduct phishing attacks, or steal data or computing resources. Over the past decade, intrusion detection research has rarely been boring