Hello everybody,
I would like to know how can I transform the tcpdump data to KDDCup99 Intrusion Detection Dataset format.
I have a trained neural network (with KDDCup99 dataset) and I need validate this neural network with a real network traffic (obtained via tcpdump).
This dataset contains 41 features, but I dont know how can I preprocess the tcpdump data to be like KDDCup.
The link for dataset is following:
http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html
Probably you could use Tcpreplay instead (http://tcpreplay.appneta.com/) and follow this method (see attached). Otherwise, you need to write a parser using any scripting language of your choice (TCL or Perl are excellent for file formatting).
Hope it helps to answer your question.
You can use tshark for convert tcpdump data into csv format. To convert the tcpdump data to KDDCUp format you have to write more codes for preprocessing. it cann't directly extract from tcpdump file to 42 features as in KDDcup99. Some basic packet features are directly extracted. But those are required processing , you have to write individual code for them.
As u r aware of the KDDCup data is nothing but cleaned tcpdump data. so if u have tcpdump data u clean this data as KDDCup dataset. then you can validate.
Thank you for your answers.
Can someone suggest me an Intrusion Detection Database where I'll be able to get all features just in tcpdump?
The problem of KDD is: It uses some features where I wont have access, like num_failed_logins, num_access_files, num_outbound_cmds.
So I think it would be better to use another database, where I'll get all the data only by tcpdump.
I recommend to you my paper entitled " Anomaly detection based on hybrid artificial immune principles, Information Management & Computer Security 21 (4), 288-314
these features were coded using Bro-IDS technique to generate these features. However, some of these features, such as num_failed_logins, num_access_files, num_outbound_cmds captured to represent Linux systems. Now, this is replaced with the flow-based concept.
- Badges
- Science topic
- Similar topics
- Correction