What question did this study set out to answer?

The aim is to analyze the 1999 DARPA/Lincoln Laboratory IDS evaluation data to identify artifacts using NetADHICT.

July 1, 2009

Analysis of the 1999 DARPA/Lincoln Laboratory IDS evaluation data with NetADHICT

Key Points

The aim is to analyze the 1999 DARPA/Lincoln Laboratory IDS evaluation data to identify artifacts using NetADHICT.
Data from the 1999 evaluation was analyzed using NetADHICT.
Extraction of artifacts and variation characteristics in network data.
Identification of unusual packets and host distribution patterns.
Extreme temporal variation was identified in the data not seen in previous analyses.
Artifacts such as uniform host distribution were successfully extracted.
NetADHICT demonstrated utility in characterizing network traces for experiments.

Abstract

The 1999 DARPA/Lincoln Laboratory IDS evaluation data has been widely used in the intrusion detection and networking community, even though it is known to have a number of artifacts. Here we show that many of these artifacts, including the lack of damaged or unusual background packets and uniform host distribution, can be easily extracted using NetADHICT, a tool we developed for understanding networks. In addition, using NetADHICT we were able to identify extreme temporal variation in the data, a characteristic that was not identified in past analyses. These results illustrate the utility of NetADHICT in characterizing network traces for experimental purposes.

KI fragen

Bookmark