| 2008 | An Empirical Approach to Identify Information Misuse by Insiders (Extended Abstract). | Deanna D. Caputo, Greg Stephens, Brad Stephenson, Megan Cormier, Minna Kim |
| 2008 | Monitoring the Execution of Third-Party Software on Mobile Devices. | Andrew Brown, Mark Ryan |
| 2008 | Streaming Estimation of Information-Theoretic Metrics for Anomaly Detection (Extended Abstract). | Sergey Bratus, Joshua Brody, David Kotz, Anna Shubina |
| 2008 | A Comparative Evaluation of Anomaly Detectors under Portscan Attacks. | Ayesha Binte Ashfaq, Maria Joseph Robert, Asma Mumtaz, Muhammad Qasim Ali, Ali Sajjad, Syed Ali Khayam |
| 2008 | A Multi-Sensor Model to Improve Automated Attack Detection. | Magnus Almgren, Ulf Lindqvist, Erland Jonsson |
| 2008 | Advanced Network Fingerprinting. | Humberto J. Abdelnur, Radu State, Olivier Festor |
| 2007 | A Forced Sampled Execution Approach to Kernel Rootkit Identification. | Jeffrey Wilhelm, Tzi-cker Chiueh |
| 2007 | Cost-Sensitive Intrusion Responses for Mobile Ad Hoc Networks. | Shiau-Huey Wang, Chinyang Henry Tseng, Karl N. Levitt, Matt Bishop |
| 2007 | The NIDS Cluster: Scalable, Stateful Network Intrusion Detection on Commodity Hardware. | Matthias Vallentin, Robin Sommer, Jason Lee, Craig Leres, Vern Paxson, Brian Tierney |
| 2007 | Alert Verification Evasion Through Server Response Forging. | Adam D. Todd, Richard A. Raines, Rusty O. Baldwin, Barry E. Mullins, Steven K. Rogers |
| 2007 | Understanding Precision in Host Based Intrusion Detection. | Monirul Islam Sharif, Kapil Singh, Jonathon T. Giffin, Wenke Lee |
| 2007 | Emulation-Based Detection of Non-self-contained Polymorphic Shellcode. | Michalis Polychronakis, Kostas G. Anagnostakis, Evangelos P. Markatos |
| 2007 | Exploiting Execution Context for the Detection of Anomalous System Calls. | Darren Mutz, William K. Robertson, Giovanni Vigna, Richard A. Kemmerer |
| 2007 | elicit: A System for Detecting Insiders Who Violate Need-to-Know. | Marcus A. Maloof, Gregory D. Stephens |
| 2007 | On the Use of Different Statistical Tests for Alert Correlation - Short Paper. | Federico Maggi, Stefano Zanero |
| 2007 | SpyShield: Preserving Privacy from Spy Add-Ons. | Zhuowei Li, XiaoFeng Wang, Jong Youl Choi |
| 2007 | Vortex: Enabling Cooperative Selective Wormholing for Network Security Systems. | John R. Lange, Peter A. Dinda, Fabin E. Bustamante |
| 2007 | "Out-of-the-Box" Monitoring of VM-Based High-Interaction Honeypots. | Xuxian Jiang, Xinyuan Wang |
| 2007 | Comparing Anomaly Detection Techniques for HTTP. | Kenneth L. Ingham, Hajime Inoue |
| 2007 | Swaddler: An Approach for the Anomaly-Based Detection of State Violations in Web Applications. | Marco Cova, Davide Balzarotti, Viktoria Felmetsger, Giovanni Vigna |
| 2007 | Hit-List Worm Detection and Bot Identification in Large Networks Using Protocol Graphs. | M. Patrick Collins, Michael K. Reiter |
| 2007 | Advanced Allergy Attacks: Does a Corpus Really Help? | Simon P. Chung, Aloysius K. Mok |
| 2007 | Automated Classification and Analysis of Internet Malware. | Michael D. Bailey, Jon Oberheide, Jon Andersen, Zhuoqing Morley Mao, Farnam Jahanian, Jose Nazario |
| 2006 | Anagram: A Content Anomaly Detector Resistant to Mimicry Attack. | Ke Wang, Janak J. Parekh, Salvatore J. Stolfo |
| 2006 | DEMEM: Distributed Evidence-Driven Message Exchange Intrusion Detection Model for MANET. | Chinyang Henry Tseng, Shiau-Huey Wang, Calvin Ko, Karl N. Levitt |