Re: IDS Datasets

[Stefano Zanero <zanero () elet polimi it>]

trantichphuoc () yahoo com wrote:

> data published by MIT & DARPA (http://www.ll.mit.edu/IST/ideval/)

> 1. This dataset was published since 1999, which is quite long time

It is not just outdated, it also contains a lot of artifacts and
well-known mistakes.

> ago. However, since then, there is no other "wellknown" dataset of
> IDS published. I would like to ask if there is some good IDS datasets
> (ready for AI techniques) but I am not aware of?

Simple answer: no, particularly if you are looking for a labeled dataset.

> 2. What is tcp-dump?

http://www.tcpdump.org/tcpdump_man.html

> What I got from the DARPA dataset was a text file with several lines,

There are also .tcpdump files that are packet captures in libpcap format.

Best,
Stefano Zanero

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------