If you model the set of alarms produced by Snort over the 1999 MIT DARPA Data Set as a first order Markov Chain, it looks like this. Publications:
Refereed Journal Articles:
1) Treinen, James J., Miller-Frost, Susan L. Following the Sun : Case Studies in Global Software Development.
In : IBM Systems Journal, Volume 45, Number 4, October 2006. [Online][PDF]
Refereed Conference Papers:
1) Treinen, James J., Thurimella, Ramakrishna. A Framework for the Application of Association Rule Mining in Large Intrusion Detection Infrastructures. In : Proceedings of the 9th Annual International Symposium On Recent Advances in Intrusion Detection. p(1-18). Hamburg, Germany, September, 2006 (RAID 2006).
[PDF][Springer Verlag]
2) Treinen, James J., Thurimella, Ramakrishna. Application of the PageRank Algorithm to Alarm Graphs In : Proceedings of the 9th Annual International Conference on Information and Communications Security. Zhengzhou, China, December, 2007 (ICICS 2007). [PDF]
3) Treinen, James J., Thurimella, Ramakrishna. Finding The Needle: Suppression of False Alarms in Large Intrusion Detection Data Sets. In : Accepted for Publication, EUC 2009, Vancouver, Canada.
Invited Talks:
1) Treinen, James J. The Changing Nature of Crime. Keynote Address given at the University of Nebraska at Lincoln Third Annual Nebraska Information Technology Security Day. Lincoln, NE, USA. November 30, 2006.
[Web]
PhD Thesis: Heuristics for Improved Enterprise Intrusion Detection. In : Doctoral Dissertation Accepted by the College of Engineering and Computer Science at the University of Denver, May, 2009. [PDF]
Patents:
1) System, Method and Program for Visually Presenting Data Describing Network Intrusions. Pending.
2) System, Method and Program Product For Identifying Newtwork-Attack Profiles And Blocking Network Intrusion. Pending.
