Dear Brothers/Sisters,
I have few questions regarding the UNSW-NB15 dataset. 1-Why the (IP addresses and Ports) not included in the training and testing files ? 2- I am using Weka to do some experiments regarding these attributes (IP addresses and Ports), which files i should use for training and testing that contain these attributes ?
Thanks
http://www.kdd.org/kdd-cup/view/kdd-cup-1999/Data
Conference Paper UNSW-NB15: a comprehensive data set for network intrusion de...
https://pdfs.semanticscholar.org/a403/951e44231dc55f752f61e10b01e4fb9a1189.pdf
Datasets
http://www.unb.ca/cic/datasets/index.html
IP addresses and Ports are not included in training and testing sets because these attributes can easily be spoofed. Hence, including these attributes for classifier training will be just a waste work. Others attributes are not spoofed thus helpful for classification tasks i.e. intrusion detection.
I think IP Addresses and Ports could be useful attributes to determine the normal behaviour of a host. However, you have to be careful that your classifier does not learn rules like "all flows from IP Address X are malicious" or "Port scans can only be executed by IP Address Y".
Maybe your are interested in our work IP2Vec (https://ieeexplore.ieee.org/document/8215725/). In this work, we use an neuronal network to transfer IP Addresses (which are categorical attributes) to meaningful continuous vectors based on their network connections.
Best Regards
Markus
- Badges
- Science topic
- Similar topics
- Correction