SRI International's System Design Laboratory has been actively involved in intrusion-detection research since 1983. Our first project, the Intrusion Detection Expert System (IDES), was a rule-based expert system trained to detect known malicious activity. That system was polished and enhanced to form NIDES, the Next-Generation Intrusion Detection Expert System. Currently, our research focuses on EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances, a modern system designed to detect and respond to today's network attacks.

• Dr. Linda Briesemeister
• Dr. Steven Cheung
• Dr. Ulf Lindqvist
• Martin Fong
• Dr. Peter Neumann
• Keith Skinner
• Dr. Vinod Yegneswaran
• Guofei Gu (Georgia Intitute of Technology)
• Mohamed Abdelfattah (Georgia Intitute of Technology)
• Raman Sharykin (University of Illinois at Urbana-Champaign)
• Vishwas Bhat (University of Texas at Austin)

• Correlated Attack Modeling (CAM)
• Cyber-Threat Analytics (Cyber-TA)
• eBayes
• Evaluation Methods for Internet Security Technology (EMIST)
• Event Monitoring Enabling Responses to Anomalous Live Disturbances (EMERALD)
• Next-Generation Intrusion-Detection Expert System (NIDES)

• Malware Characterization through Alert Pattern Discovery  (2009)
• The Use of White Holes to Mislead and Defeat Importance Scanning Worm  (2007)
• Applying Formal Evaluation to Worm Defense Design  (2007)
• Automatically Deducing Propagation Sequences that Circumvent a Collaborative Worm Defense  (2006)
• Formally Specifying Design Goals of Worm Defense Strategies  (2006)
• Model Checking of Worm Quarantine and Counter-Quarantine under a Group Defense  (2005)
• Microscopic Simulation of a Group Defense Strategy  (2005)
• A Hybrid Quarantine Defense  (2004)
• Correlated Attack Modeling (CAM)  (2003)
• Modeling Multistep Cyber Attacks for Scenario Recognition  (2003)
• Probabilistic Alert Correlation  (2001)
• eXpert-BSM: A Host-based Intrusion Detection Solution for Sun Solaris  (2001)
• Application-Integrated Data Collection for Security Monitoring  (2001)
• Adaptive, Model-based Monitoring for Cyber Attack Detection  (2000)
• Experience with EMERALD to Date  (1999)
• Detecting Computer and Network Misuse Through the Production-Based Expert System Toolset (P-BEST)  (1999)
• Live Traffic Analysis of TCP/IP Gateways  (1998)
• EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances  (1997)
• EMERALD: Conceptual Overview Statement  (1996)
• NIDES: A Summary  (1995)
• Detecting Unusual Program Behavior Using the Statistical Components of NIDES  (1995)
• Size Format SAFEGUARD Final Report: Detecting Unusual Program Behavior Using the NIDES Statistical Component  (1995)
• NIDES: Software Users Manual -- Beta-Update Release  (1994)
• NIDES: Training Course -- Beta Release  (1994)
• The NIDES Statistical Component: Description and Justification  (1993)
• IDES: A Progress Report  (1990)
• IDES: The Enhanced Prototype  (1988)

Read more about the history of Intrusion Detection at SRI.