Re: Re: HTTP LOG files Labeling

[wangweifrequent () gmail com]

In fact, we have designed a (good) online and adaptive anomaly detection method for detecting HTTP attacks. 

We have obtained the detection results with our methods but we have to know which lines are real attacks and which 
lines are not so that we can compute the true positive rates and false positive rates to evaluate our anomaly detection 
methods. 

Ideally labeling the HTTP logs is to use a precise signature-based IDS (e.g., snort), but we didn't use it during data 
collection. So my question is how can I automatically label the the HTTP log files (have no tcp/ip traffic now)? 
considering that the size of the HTTP log files is very large and the labeling is normally difficult by our eyes and 
our hand.

Thanks,

INRIA France
Wei WANG

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------