There are following 41 attributes ( Features). 1. duration: continuous.2. protocol_type: symbolic. 3. service: symbolic. 4. flag: symbolic. 5. src_bytes: continuous. 6. dst_bytes: continuous. 7. land: symbolic. 8. wrong_fragment: continuous. 9. urgent: continuous. 10. hot: continuous. 11. num_failed_logins: continuous. 12. logged_in: symbolic. 13. num_compromised: continuous. 14. root_shell: continuous. 15. su_attempted: continuous. 16. num_root: continuous. 17. num_file_creations: continuous. 18. num_shells: continuous. 19. num_access_files: continuous. 20. num_outbound_cmds: continuous. 21. is_host_login: symbolic. 22. is_guest_login: symbolic. 23. count: continuous. 24. srv_count: continuous. 25. serror_rate: continuous. 26. srv_serror_rate: continuous. 27. rerror_rate: continuous. 28. srv_rerror_rate: continuous. 29. same_srv_rate: continuous. 30. diff_srv_rate: continuous. 31. srv_diff_host_rate: continuous. 32. dst_host_count: continuous. 33. dst_host_srv_count: continuous. 34. dst_host_same_srv_rate: continuous. 35. dst_host_diff_srv_rate: continuous. 36. dst_host_same_src_port_rate: continuous. 37. dst_host_srv_diff_host_rate: continuous. 38. dst_host_serror_rate: continuous. 39. dst_host_srv_serror_rate: continuous. 40. dst_host_rerror_rate: continuous. 41. dst_host_srv_rerror_rate: continuous.
These attributes are used to identify following attacks:
back,buffer_overflow,ftp_write,guess_passwd,imap,ipsweep,land,loadmodule,multihop,neptune,nmap,normal,perl,phf,pod,portsweep,rootkit,satan,smurf,spy,teardrop,warezclient,warezmaster.
- Badges
- Science topic