Hello everybody.
I'm implementing an Network Intrusion Detection System with Neural Networks.
But, to apply this method in a real network, I need a "parser".
I have a question about the two-second time windows of KDD Cup 99 (Table 3 of http://kdd.ics.uci.edu/databases/kddcup99/task.html).
How it works? I need get the last two-second of each connection or the last two-second before each connection? Or something else?
http://kdd.ics.uci.edu/databases/kddcup99/task.html
You need the last 2 seconds prior to the particular packet in which the data resides.
Hello Terrence. Ok, I understand it.
But, In this dataset have a "duration" feature, So I think that data in KDD database are of connections, not of packets. Therefore I should get data from the last 2 seconds of the connection or from the first 2 seconds of the connection? I dont know which part of the connection I should get.
Hi Scalco
some of KDD features can not be extracted from the packet but it can be from the behave of the packet .
these features to be record , you need at least two sec. of the connection life starting .
after passing two seconds , you must record these features and at each point, you record the event of the packet in the past 2 sec.
I hope that help
- Badges
- Science topic