| ID '99 | Intrusion Detection Through Dynamic Software Measurement | Sebastian Elbaum, John C. Munson |
| ID '99 | Learning Program Behavior Profiles for Intrusion Detection | Anup Ghosh, Aaron Schwartzbard, Michael Schatz |
| ID '99 | Automated Intrusion Detection Methods Using NFR | Wenke Lee, Christopher Park, Salvatore J. Stolfo |
| ID '99 | Experience with EMERALD Thus Far | Phillip A. Porras, Peter G. Neumann, Teresa Lunt |
| ID '99 | Defending Against the Wily Surfer -Web-Based Attacks and Defenses | Dan Klein |
| ID '99 | Preprocessor Algorithm for Network Management Codebook | Minaxi Gupta, Mani Subramanian |
| ID '99 | The Packet Vault: Secure Storage of Network Data | Charles J. Antonelli, Matthew Undy, Peter Honeyman |
| ID '99 | Real-Time Intrusion Detection and Suppression in ATM Networks | Ricardo Bettati, Wei Zhao, Dan Teodor |
| ID '99 | A Statistical Method for Profiling Network Traffic | David Marchette |
| ID '99 | Transaction-Based Anomaly Detection | Roland Buschkes, Mark Borning |
| ID '99 | Analysis Techniques for Detecting Coordinated Attacks and Probes | Tim Aldrich, Stephen Northcutt, Bill Ralph, John Green |
| ID '99 | Intrusion Detection and Intrusion Prevention on a Large Network: A Case Study | Tom Dunigan, Greg Hinkel |
| ID '99 | An Eye on Network Intruder-Administrator Shootouts | Luc Girardin |
| ID '99 | On Preventing Intrusions by Process Behavior Monitoring | R. Sekar, Thomas Bowen |
