Dear all,
I was wondering how normally people test their machine learning
algorithims in MIT darpa dataset?
I asked this question because I found that :
1) There is a time gap between the published list of attack to the
dataset. For instance APACHE2 attack, the published list of attack say the
attack was start on 00:00:40 (not the fake time), normally I see the
attack within +-10 seconds of the published list of attack (this is by
looking directly on the payload)
2) Many of U2R attack are in port 23. For instance the attacker executes
the command : $./exploit
In the real dataset especially for per packet model, it will get
translated to many packets i.e
1st packet contains "$"
2st packet contains "."
3rd packet contains "/"
4th packet contains "e"
If the IDS identified say the 4th packet as anomalous , is it justifiable
to say that the IDS detects the particular attack?
thanks
Wilmar Sulaiman
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
