1. The assistance of Jim Mellander of Berkeley Lab and Josh Gray of MITRE Corporation, both of whom provided helpful insights and comments on a previous version of this paper, is gratefully acknowledged.
2. CERT/CC, CERT/CC current activity. Web document, 2002. http:///current/current_activity.html www.cert.org/current/current_activity.html
3. Usually “unauthorized” implies that a violation of stated information security policy has occurred. Unfortunately, many organizations have not done an adequate job of defining their policies, however, so defining an attack as a policy violation is not always appropriate.
4. McHugh, J., Christie, A. & Allen, J. Intrusion detection: Implementation and operational issues. Web document, 2001. http://www.stsc.hill.af.mil/crosstalk/2001/jan/mchugh.asp
5. Schultz, E. & Spafford, E., Intrusion detection: How to utilize a still immature technology. In Tipton, H. and Krause, M., Information Security Management Handbook (4th Edition), Boca Raton: Auerbach, 2000.