Analysis of the 1999 DARPA/Lincoln Laboratory IDS evaluation data with NetADHICT
Analysis of the 1999 DARPA/Lincoln Laboratory IDS evaluation data with NetADHICT
复制标题
使用 NetADHICT 分析 1999 年 DARPA/林肯实验室 IDS 评估数据
DOI：
--
复制
发表时间：
2009
期刊：
影响因子：
--
通讯作者：
Anil Somayaji
中科院分区：
文献类型：
--
作者：
Carson D. Brown;Alex Cowperthwaite;Abdulrahman Hijazi;Anil Somayaji
1999年DARPA/林肯实验室的IDS评估数据已被广泛用于入侵检测和网络社区，即使它是已知的有一些工件。在这里，我们表明，许多这些文物，包括缺乏损坏或不寻常的背景数据包和统一的主机分布，可以很容易地提取使用NetADHICT，我们开发的工具来了解网络。此外，使用NetADHICT，我们能够识别数据中的极端时间变化，这是过去分析中没有发现的特征。这些结果说明了实用的NetADHICT在表征网络痕迹的实验目的。
The 1999 DARPA/Lincoln Laboratory IDS Evaluation Data has been widely used in the intrusion detection and networking community, even though it is known to have a number of artifacts. Here we show that many of these artifacts, including the lack of damaged or unusual background packets and uniform host distribution, can be easily extracted using NetADHICT, a tool we developed for understanding networks. In addition, using NetADHICT we were able to identify extreme temporal variation in the data, a characteristic that was not identified in past analyses. These results illustrate the utility of NetADHICT in characterizing network traces for experimental purposes.