Re: IDS Datasets

[SanjayR <sanjayr () intoto com>]

Hi Patrick:
you must be knowing that any learning algorithm is as good as the 
data presented to it for training. This implies that one should have 
a very good understanding of data to be used with any learning algo. 
From your mail, it appears that you have very little knowledge (or 
not at all) of data used (created by) network devices. Therefore, i 
advise you to first get yourself familiar with network and related 
tools (Tcpdump is one of them) and then start working on with your 
proposal of combining AI and IDS. For that, you would like to look at 
work done at Columbia Univ, UC davic, Purdue, Gtech etc. Other option 
is to have someone in your group who is familiar with IDS domain.

regards
-Sanjay
At 07:08 AM 8/28/2006, trantichphuoc () yahoo com wrote:
> Hi there,
> I am a newbie in this forum. I am more concerned on Auritficial 
> Intelligence (Machine Learning) techniques rather than the IDS 
> itself. However, I would like to test some machine learning 
> techniques (Neural Networks, ...) in the domain of IDS, i.e. use AI 
> to analyse some available datasets of intrusions.
> I found the IDS data published by MIT & DARPA 
> (http://www.ll.mit.edu/IST/ideval/) which is quite wellknown I 
> suppose. I have the following questions:
> 1. This dataset was published since 1999, which is quite long time 
> ago. However, since then, there is no other "wellknown" dataset of 
> IDS published. I would like to ask if there is some good IDS 
> datasets (ready for AI techniques) but I am not aware of?
> 2. What is tcp-dump? What I got from the DARPA dataset was a text 
> file with several lines, each line has several attributes separated 
> by commas. How an IDS can understand this text file? I am confusing 
> between the AI-ready datasets (text files that are preprocessed) and 
> the files generated originally from a real IDS.
> Thanks
> Patrick Tran
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------

Sanjay Rawat
Security Research Engineer
INTOTO Software (India) Private Limited
Uma Plaza, Nagarjuna Hills
PunjaGutta,Hyderabad 500082 | India
Office: + 91 40 23358927/28 Extn 424
Website : www.intoto.com
  Homepage: http://sanjay-rawat.tripod.com





------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------