{ "data_id": "1110", "name": "KDDCup99_full", "exact_name": "KDDCup99_full", "version": 1, "version_label": null, "description": "**Author**: \n**Source**: Unknown - Date unknown \n**Please cite**: \n\nDatasets from ACM KDD Cup (http:\/\/www.sigkdd.org\/kddcup\/index.php)\n\nData set for KDD Cup 1999\n\nModified by TunedIT (converted to ARFF format)\n\nhttp:\/\/www.sigkdd.org\/kddcup\/index.php?section=1999&method=info\nThis is the data set used for The Third International Knowledge Discovery and Data Mining Tools Competition, which was held in conjunction with KDD-99 The Fifth International Conference on Knowledge Discovery and Data Mining. The competition task was to build a network intrusion detector, a predictive model capable of distinguishing between ``bad'' connections, called intrusions or attacks, and \"good\" normal connections. This database contains a standard set of data to be audited, which includes a wide variety of intrusions simulated in a military network environment.\nThe training and test datasets are also available in the UC Irvine KDD archive.\n\n\n\n\nKDD Cup 1999: Tasks\n\nThis document is adapted from the paper Cost-based Modeling and Evaluation for Data Mining With Application to Fraud and Intrusion Detection: Results from the JAM Project by Salvatore J. Stolfo, Wei Fan, Wenke Lee, Andreas Prodromidis, and Philip K. Chan.\n\nIntrusion Detector Learning\n\nSoftware to detect network intrusions protects a computer network from unauthorized users, including perhaps insiders. The intrusion detector learning task is to build a predictive model (i.e. a classifier) capable of distinguishing between ``bad'' connections, called intrusions or attacks, and ``good'' normal connections.\n\nThe 1998 DARPA Intrusion Detection Evaluation Program was prepared and managed by MIT Lincoln Labs. The objective was to survey and evaluate research in intrusion detection. A standard set of data to be audited, which includes a wide variety of intrusions simulated in a military network environment, was provided. The 1999 KDD intrusion detection contest uses a version of this dataset.\n\nLincoln Labs set up an environment to acquire nine weeks of raw TCP dump data for a local-area network (LAN) simulating a typical U.S. Air Force LAN. They operated the LAN as if it were a true Air Force environment, but peppered it with multiple attacks.\n\nThe raw training data was about four gigabytes of compressed binary TCP dump data from seven weeks of network traffic. This was processed into about five million connection records. Similarly, the two weeks of test data yielded around two million connection records.\n\nA connection is a sequence of TCP packets starting and ending at some well defined times, between which data flows to and from a source IP address to a target IP address under some well defined protocol. Each connection is labeled as either normal, or as an attack, with exactly one specific attack type. Each connection record consists of about 100 bytes.\n\nAttacks fall into four main categories:\n\n* DOS: denial-of-service, e.g. syn flood;\n* R2L: unauthorized access from a remote machine, e.g. guessing password;\n* U2R: unauthorized access to local superuser (root) privileges, e.g., various ``buffer overflow'' attacks;\n* probing: surveillance and other probing, e.g., port scanning.\n\nIt is important to note that the test data is not from the same probability distribution as the training data, and it includes specific attack types not in the training data. This makes the task more realistic. Some intrusion experts believe that most novel attacks are variants of known attacks and the \"signature\" of known attacks can be sufficient to catch novel variants. The datasets contain a total of 24 training attack types, with an additional 14 types in the test data only.\n\nDerived Features\n\nStolfo et al. defined higher-level features that help in distinguishing normal connections from attacks. There are several categories of derived features.\n\nThe ``same host'' features examine only the connections in the past two seconds that have the same destination host as the current connection, and calculate statistics related to protocol behavior, service, etc.\n\nThe similar ``same service'' features examine only the connections in the past two seconds that have the same service as the current connection.\n\n\"Same host\" and \"same service\" features are together called time-based traffic features of the connection records.\n\nSome probing attacks scan the hosts (or ports) using a much larger time interval than two seconds, for example once per minute. Therefore, connection records were also sorted by destination host, and features were constructed using a window of 100 connections to the same host instead of a time window. This yields a set of so-called host-based traffic features.\n\nUnlike most of the DOS and probing attacks, there appear to be no sequential patterns that are frequent in records of R2L and U2R attacks. This is because the DOS and probing attacks involve many connections to some host(s) in a very short period of time, but the R2L and U2R attacks are embedded in the data portions of packets, and normally involve only a single connection.\n\nUseful algorithms for mining the unstructured data portions of packets automatically are an open research question. Stolfo et al. used domain knowledge to add features that look for suspicious behavior in the data portions, such as the number of failed login attempts. These features are called ``content'' features.\n\nA complete listing of the set of features defined for the connection records is given in the three tables below. The data schema of the contest dataset is available in machine-readable form.\n\nfeature name \tdescription \ttype\nduration \tlength (number of seconds) of the connection \tcontinuous\nprotocol_type \ttype of the protocol, e.g. tcp, udp, etc. \tdiscrete\nservice \tnetwork service on the destination, e.g., http, telnet, etc. \tdiscrete\nsrc_bytes \tnumber of data bytes from source to destination \tcontinuous\ndst_bytes \tnumber of data bytes from destination to source \tcontinuous\nflag \tnormal or error status of the connection \tdiscrete\nland \t1 if connection is from\/to the same host\/port; 0 otherwise \tdiscrete\nwrong_fragment \tnumber of ``wrong'' fragments \tcontinuous\nurgent \tnumber of urgent packets \tcontinuous\n\nTable 1: Basic features of individual TCP connections.\n\nfeature name \tdescription \ttype\nhot \tnumber of ``hot'' indicators \tcontinuous\nnum_failed_logins \tnumber of failed login attempts \tcontinuous\nlogged_in \t1 if successfully logged in; 0 otherwise \tdiscrete\nnum_compromised \tnumber of ``compromised'' conditions \tcontinuous\nroot_shell \t1 if root shell is obtained; 0 otherwise \tdiscrete\nsu_attempted \t1 if ``su root'' command attempted; 0 otherwise \tdiscrete\nnum_root \tnumber of ``root'' accesses \tcontinuous\nnum_file_creations \tnumber of file creation operations \tcontinuous\nnum_shells \tnumber of shell prompts \tcontinuous\nnum_access_files \tnumber of operations on access control files \tcontinuous\nnum_outbound_cmds \tnumber of outbound commands in an ftp session \tcontinuous\nis_hot_login \t1 if the login belongs to the ``hot'' list; 0 otherwise \tdiscrete\nis_guest_login \t1 if the login is a ``guest''login; 0 otherwise \tdiscrete\n\nTable 2: Content features within a connection suggested by domain knowledge.\n\nfeature name \tdescription \ttype\ncount \tnumber of connections to the same host as the current connection in the past two seconds \tcontinuous\nNote: The following features refer to these same-host connections.\nserror_rate \t% of connections that have ``SYN'' errors \tcontinuous\nrerror_rate \t% of connections that have ``REJ'' errors \tcontinuous\nsame_srv_rate \t% of connections to the same service \tcontinuous\ndiff_srv_rate \t% of connections to different services \tcontinuous\nsrv_count \tnumber of connections to the same service as the current connection in the past two seconds \tcontinuous\nNote: The following features refer to these same-service connections.\nsrv_serror_rate \t% of connections that have ``SYN'' errors \tcontinuous\nsrv_rerror_rate \t% of connections that have ``REJ'' errors \tcontinuous\nsrv_diff_host_rate \t% of connections to different hosts \tcontinuous\n\nTable 3: Traffic features computed using a two-second time window.\n\n\n\n\nhttp:\/\/www.sigkdd.org\/kddcup", "format": "ARFF", "uploader": "Joaquin Vanschoren", "uploader_id": 2, "visibility": "public", "creator": null, "contributor": null, "date": "2014-10-07 00:07:44", "update_comment": null, "last_update": "2014-10-07 00:07:44", "licence": "Public", "status": "active", "error_message": null, "url": "https:\/\/www.openml.org\/data\/download\/53993\/KDDCup99_full.arff", "default_target_attribute": "label", "row_id_attribute": null, "ignore_attribute": null, "runs": 4, "suggest": { "input": [ "KDDCup99_full", "Datasets from ACM KDD Cup (http:\/\/www.sigkdd.org\/kddcup\/index.php) Data set for KDD Cup 1999 Modified by TunedIT (converted to ARFF format) http:\/\/www.sigkdd.org\/kddcup\/index.php?section=1999&method=info This is the data set used for The Third International Knowledge Discovery and Data Mining Tools Competition, which was held in conjunction with KDD-99 The Fifth International Conference on Knowledge Discovery and Data Mining. The competition task was to build a network intrusion detector, a pred " ], "weight": 5 }, "qualities": { "NumberOfInstances": 4898431, "NumberOfFeatures": 42, "NumberOfClasses": 23, "NumberOfMissingValues": 0, "NumberOfInstancesWithMissingValues": 0, "NumberOfNumericFeatures": 34, "NumberOfSymbolicFeatures": 8, "REPTreeDepth3Kappa": 0.9996840135309316, "DecisionStumpKappa": 0.6401010924152701, "MaxMeansOfNumericAtts": 1834.6211752239933, "MinMutualInformation": 9.5219631e-7, "Quartile2SkewnessOfNumericAtts": 6.919579767073051, "RandomTreeDepth1AUC": 0.9999208438127098, "Dimensionality": 8.574174056958238e-6, "MaxMutualInformation": 1.33485690039055, "MinNominalAttDistinctValues": 2, "PercentageOfBinaryFeatures": 9.523809523809524, "Quartile2StdDevOfNumericAtts": 0.30724930485583857, "RandomTreeDepth1ErrRate": 0.00014494437096286545, "EquivalentNumberOfAtts": 2.9461578095780228, "MaxNominalAttDistinctValues": 70, "MinSkewnessOfNumericAtts": -2.769937134117551, "PercentageOfInstancesWithMissingValues": 0, "Quartile3AttributeEntropy": 1.1718491974554408, "RandomTreeDepth1Kappa": 0.9997518310505028, "J48.00001.AUC": 0.9999745345381997, "MaxSkewnessOfNumericAtts": 1807.567216823484, "MinStdDevOfNumericAtts": 0, "PercentageOfMissingValues": 0, "Quartile3KurtosisOfNumericAtts": 31538.876879085015, "AutoCorrelation": 0.9998736329803631, "RandomTreeDepth2AUC": 0.9999208438127098, "J48.00001.ErrRate": 0.00010452326469434805, "MaxStdDevOfNumericAtts": 941431.0744840805, "MinorityClassPercentage": 4.082940027122971e-5, "PercentageOfNumericFeatures": 80.95238095238095, "Quartile3MeansOfNumericAtts": 0.7627559707382677, "CfsSubsetEval_DecisionStumpAUC": 0.9999684487419668, "RandomTreeDepth2ErrRate": 0.00014494437096286545, "J48.00001.Kappa": 0.999821039095372, "MeanAttributeEntropy": 0.6631620782674428, "MinorityClassSize": 2, "PercentageOfSymbolicFeatures": 19.047619047619047, "Quartile3MutualInformation": 1.00729126948678, "CfsSubsetEval_DecisionStumpErrRate": 0.0006357137622230465, "RandomTreeDepth2Kappa": 0.9997518310505028, "J48.0001.AUC": 0.9999745345381997, "MeanKurtosisOfNumericAtts": 420300.4504113687, "NaiveBayesAUC": 0.9996286271851994, "Quartile1AttributeEntropy": 0.00010780151438917712, "Quartile3SkewnessOfNumericAtts": 161.5421667699253, "CfsSubsetEval_DecisionStumpKappa": 0.9989116189992167, "RandomTreeDepth3AUC": 0.9999208438127098, "J48.0001.ErrRate": 0.00010452326469434805, "MeanMeansOfNumericAtts": 118.59520717662451, "NaiveBayesErrRate": 0.10711633990557384, "Quartile1KurtosisOfNumericAtts": 0.8438859860480195, "Quartile3StdDevOfNumericAtts": 3.8768796013719005, "CfsSubsetEval_NaiveBayesAUC": 0.9999684487419668, "RandomTreeDepth3ErrRate": 0.00014494437096286545, "J48.0001.Kappa": 0.999821039095372, "MeanMutualInformation": 0.5048430513228586, "NaiveBayesKappa": 0.8230342816213663, "Quartile1MeansOfNumericAtts": 0.0011468468168765661, "REPTreeDepth1AUC": 0.9999623165502963, "CfsSubsetEval_NaiveBayesErrRate": 0.0006357137622230465, "RandomTreeDepth3Kappa": 0.9997518310505028, "J48.001.AUC": 0.9999745345381997, "MeanNoiseToSignalRatio": 0.3136004873786717, "NumberOfBinaryFeatures": 4, "Quartile1MutualInformation": 8.132576467e-5, "REPTreeDepth1ErrRate": 0.00018454888922595828, "CfsSubsetEval_NaiveBayesKappa": 0.9989116189992167, "CfsSubsetEval_kNN1NAUC": 0.9999684487419668, "StdvNominalAttDistinctValues": 23.66997797089928, "J48.001.ErrRate": 0.00010452326469434805, "MeanNominalAttDistinctValues": 14.375, "Quartile1SkewnessOfNumericAtts": 1.6850863225113506, "REPTreeDepth1Kappa": 0.9996840135309316, "CfsSubsetEval_kNN1NErrRate": 0.0006357137622230465, "kNN1NAUC": 0.9999806058900994, "J48.001.Kappa": 0.999821039095372, "MeanSkewnessOfNumericAtts": 267.90052532086065, "Quartile1StdDevOfNumericAtts": 0.04245569737825759, "REPTreeDepth2AUC": 0.9999623165502963, "CfsSubsetEval_kNN1NKappa": 0.9989116189992167, "kNN1NErrRate": 0.00012697943484352438, "MajorityClassPercentage": 57.322150704991046, "MeanStdDevOfNumericAtts": 46700.21383673186, "Quartile2AttributeEntropy": 0.5934068994475641, "REPTreeDepth2ErrRate": 0.00018454888922595828, "ClassEntropy": 1.4873472982660383, "kNN1NKappa": 0.9997825913571945, "MajorityClassSize": 2807886, "MinAttributeEntropy": 9.254629914813058e-6, "Quartile2KurtosisOfNumericAtts": 51.26419741801909, "REPTreeDepth2Kappa": 0.9996840135309316, "REPTreeDepth3AUC": 0.9999623165502963, "DecisionStumpAUC": 0.9398448474177091, "MaxAttributeEntropy": 1.8668497205694936, "MinKurtosisOfNumericAtts": -1.904057437045101, "Quartile2MeansOfNumericAtts": 0.05766225246398522, "REPTreeDepth3ErrRate": 0.00018454888922595828, "DecisionStumpErrRate": 0.20792943699727526, "MaxKurtosisOfNumericAtts": 3533299.05484435, "MinMeansOfNumericAtts": 0, "Quartile2MutualInformation": 0.42313209586064 }, "tags": [ { "uploader": "38960", "tag": "Chemistry" }, { "uploader": "2", "tag": "concept_drift" }, { "uploader": "38960", "tag": "Life Science" } ], "features": [ { "name": "label", "index": "41", "type": "nominal", "distinct": "23", "missing": "0", "target": "1", "distr": [ [ "back", "teardrop", "loadmodule", "neptune", "rootkit", "phf", "satan", "buffer_overflow", "ftp_write", "land", "spy", "ipsweep", "multihop", "smurf", "pod", "perl", "warezclient", "nmap", "imap", "warezmaster", "portsweep", "normal", "guess_passwd" ], [ [ "2203", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "979", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "9", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "1072017", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "10", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "4", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "15892", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "30", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "8", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "21", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "12481", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "7", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "2807886", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "264", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1020", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "2316", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "12", "0", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "20", "0", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "10413", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "972781", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "53" ] ] ] }, { "name": "duration", "index": "0", "type": "numeric", "distinct": "9883", "missing": "0", "min": "0", "max": "58329", "mean": "48", "stdev": "723" }, { "name": "protocol_type", "index": "1", "type": "nominal", "distinct": "3", "missing": "0", "distr": [ [ "tcp", "udp", "icmp" ], [ [ "2203", "0", "9", "1072017", "7", "4", "14147", "30", "8", "21", "2", "924", "7", "0", "0", "3", "1020", "1034", "12", "20", "10407", "768670", "53" ], [ "0", "979", "0", "0", "3", "0", "1708", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "250", "0", "0", "0", "191348", "0" ], [ "0", "0", "0", "0", "0", "0", "37", "0", "0", "0", "0", "11557", "0", "2807886", "264", "0", "0", "1032", "0", "0", "6", "12763", "0" ] ] ] }, { "name": "service", "index": "2", "type": "nominal", "distinct": "70", "missing": "0", "distr": [ [ "vmnet", "smtp", "ntp_u", "shell", "kshell", "aol", "imap4", "urh_i", "netbios_ssn", "tftp_u", "mtp", "uucp", "nnsp", "echo", "tim_i", "ssh", "iso_tsap", "time", "netbios_ns", "systat", "hostnames", "login", "efs", "supdup", "http_8001", "courier", "ctf", "finger", "nntp", "ftp_data", "red_i", "ldap", "http", "ftp", "pm_dump", "exec", "klogin", "auth", "netbios_dgm", "other", "link", "X11", "discard", "private", "remote_job", "IRC", "daytime", "pop_3", "pop_2", "gopher", "sunrpc", "name", "rje", "domain", "uucp_path", "http_2784", "Z39_50", "domain_u", "csnet_ns", "whois", "eco_i", "bgp", "sql_net", "printer", "telnet", "ecr_i", "urp_i", "netstat", "http_443", "harvest" ], [ [ "0", "0", "0", "1041", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "9", "0", "0" ], [ "0", "0", "0", "1140", "0", "0", "14", "0", "0", "0", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "15", "95371", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "3833", "0" ], [ "0", "0", "0", "1034", "0", "0", "4", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "7", "5", "0" ], [ "0", "0", "0", "1030", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "7", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "1043", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "12", "0", "8", "3", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "148", "0" ], [ "0", "0", "0", "1042", "0", "0", "4", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "8", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "3", "0" ], [ "0", "0", "0", "1044", "0", "0", "3", "0", "0", "0", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "15", "0", "0" ], [ "0", "0", "0", "1027", "0", "0", "6", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "7", "0", "0" ], [ "0", "0", "0", "1030", "0", "0", "1", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "6", "0", "0" ], [ "0", "0", "0", "1040", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "15", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "5", "0", "0", "0", "0", "0", "0", "7", "0" ], [ "0", "0", "0", "1039", "0", "0", "3", "0", "0", "0", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "12", "7", "0" ], [ "0", "0", "0", "1038", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "10", "0", "0" ], [ "0", "0", "0", "1040", "0", "0", "3", "0", "0", "0", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "13", "509", "0" ], [ "0", "0", "0", "1041", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "10", "0", "0" ], [ "0", "0", "0", "1038", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "14", "0", "0" ], [ "0", "0", "0", "1037", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "9", "0", "0" ], [ "0", "0", "0", "1032", "0", "0", "3", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "7", "0", "0" ], [ "0", "0", "0", "1032", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "7", "0", "0" ], [ "0", "0", "0", "1042", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "14", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "1011", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "7", "0", "0" ], [ "0", "0", "0", "1037", "0", "0", "3", "0", "0", "0", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "14", "0", "0" ], [ "0", "0", "0", "1800", "0", "0", "27", "0", "0", "20", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "13", "5017", "0" ], [ "0", "0", "0", "1043", "0", "0", "6", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "9", "0", "0" ], [ "0", "0", "3", "1805", "1", "0", "26", "8", "4", "0", "0", "13", "3", "0", "0", "0", "708", "1", "0", "18", "14", "38093", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "9", "0" ], [ "0", "0", "0", "1033", "0", "0", "1", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "6", "0", "0" ], [ "2203", "0", "0", "1801", "0", "4", "7", "0", "0", "0", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "16", "619046", "0" ], [ "0", "0", "1", "1042", "1", "0", "8", "1", "2", "0", "0", "13", "2", "0", "0", "0", "307", "1", "0", "2", "13", "3821", "0" ], [ "0", "0", "0", "0", "0", "0", "5", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "1035", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "7", "0", "0" ], [ "0", "0", "0", "1040", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "7", "0", "0" ], [ "0", "0", "0", "1037", "0", "0", "7", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "9", "2328", "0" ], [ "0", "0", "0", "1039", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "10", "0", "0" ], [ "0", "0", "0", "1022", "3", "0", "12453", "0", "0", "0", "0", "0", "0", "0", "0", "0", "5", "1", "0", "0", "2649", "56520", "0" ], [ "0", "0", "0", "1038", "0", "0", "3", "0", "0", "0", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "14", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "6", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "129", "0" ], [ "0", "0", "0", "1040", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "15", "0", "0" ], [ "0", "979", "0", "1013720", "0", "0", "3146", "0", "0", "0", "0", "702", "0", "0", "0", "0", "0", "1231", "0", "0", "7200", "73853", "0" ], [ "0", "0", "0", "1041", "0", "0", "3", "0", "0", "0", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "15", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "1", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "520", "0" ], [ "0", "0", "0", "1037", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "15", "0", "0" ], [ "0", "0", "0", "1046", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "9", "922", "0" ], [ "0", "0", "0", "1043", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "8", "0", "0" ], [ "0", "0", "0", "1039", "0", "0", "11", "0", "0", "0", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "13", "0", "0" ], [ "0", "0", "0", "1043", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "9", "0", "0" ], [ "0", "0", "0", "1036", "0", "0", "3", "0", "0", "0", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "14", "0", "0" ], [ "0", "0", "0", "1038", "0", "0", "3", "0", "0", "0", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "15", "0", "0" ], [ "0", "0", "0", "1046", "0", "0", "3", "0", "0", "0", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "12", "38", "0" ], [ "0", "0", "0", "1044", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "10", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "1", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ], [ "0", "0", "0", "1066", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "9", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "9", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "57773", "0" ], [ "0", "0", "0", "1038", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "9", "0", "0" ], [ "0", "0", "0", "1042", "0", "0", "3", "0", "0", "0", "0", "13", "0", "0", "0", "0", "0", "1", "0", "0", "14", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "23", "0", "0", "0", "0", "11517", "0", "0", "0", "0", "0", "1026", "0", "0", "4", "3768", "0" ], [ "0", "0", "0", "1035", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "9", "0", "0" ], [ "0", "0", "0", "1039", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "10", "0", "0" ], [ "0", "0", "0", "1034", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "7", "0", "0" ], [ "0", "0", "5", "1923", "5", "0", "7", "21", "0", "1", "2", "14", "2", "0", "0", "3", "0", "1", "0", "0", "13", "2227", "53" ], [ "0", "0", "0", "0", "0", "0", "11", "0", "0", "0", "0", "40", "0", "2807886", "259", "0", "0", "6", "0", "0", "2", "3456", "0" ], [ "0", "0", "0", "0", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "5375", "0" ], [ "0", "0", "0", "1038", "0", "0", "3", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "14", "0", "0" ], [ "0", "0", "0", "1036", "0", "0", "1", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "6", "0", "0" ], [ "0", "0", "0", "0", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ] ] ] }, { "name": "flag", "index": "3", "type": "nominal", "distinct": "11", "missing": "0", "distr": [ [ "RSTR", "S3", "SF", "RSTO", "SH", "OTH", "S2", "RSTOS0", "S1", "S0", "REJ" ], [ [ "91", "0", "0", "0", "0", "0", "1", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "0", "7663", "334", "4" ], [ "0", "0", "0", "0", "0", "0", "1", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "0", "0", "46", "2" ], [ "2105", "979", "9", "1", "10", "4", "1857", "29", "8", "0", "2", "11622", "7", "2807886", "264", "3", "1016", "1282", "6", "20", "8", "917208", "2" ], [ "0", "0", "0", "4600", "0", "0", "6", "1", "0", "0", "0", "36", "0", "0", "0", "0", "1", "0", "0", "0", "55", "600", "45" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1034", "4", "0", "0", "2", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "44", "13", "0" ], [ "5", "0", "0", "0", "0", "0", "2", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "0", "0", "153", "0" ], [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "122", "0", "0" ], [ "2", "0", "0", "0", "0", "0", "1", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "0", "528", "0" ], [ "0", "0", "0", "867446", "0", "0", "1746", "0", "0", "21", "0", "0", "0", "0", "0", "0", "0", "0", "1", "0", "191", "424", "0" ], [ "0", "0", "0", "199970", "0", "0", "12278", "0", "0", "0", "0", "823", "0", "0", "0", "0", "0", "0", "0", "0", "2330", "53473", "0" ] ] ] }, { "name": "src_bytes", "index": "4", "type": "numeric", "distinct": "7195", "missing": "0", "min": "0", "max": "1379963888", "mean": "1835", "stdev": "941431" }, { "name": "dst_bytes", "index": "5", "type": "numeric", "distinct": "21493", "missing": "0", "min": "0", "max": "1309937401", "mean": "1094", "stdev": "645012" }, { "name": "land", "index": "6", "type": "nominal", "distinct": "2", "missing": "0", "distr": [ [ "1", "0" ], [ [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "21", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "7", "0" ], [ "2203", "979", "9", "1072017", "10", "4", "15892", "30", "8", "0", "2", "12481", "7", "2807886", "264", "3", "1020", "2316", "12", "20", "10413", "972774", "53" ] ] ] }, { "name": "wrong_fragment", "index": "7", "type": "numeric", "distinct": "3", "missing": "0", "min": "0", "max": "3", "mean": "0", "stdev": "0" }, { "name": "urgent", "index": "8", "type": "numeric", "distinct": "6", "missing": "0", "min": "0", "max": "14", "mean": "0", "stdev": "0" }, { "name": "hot", "index": "9", "type": "numeric", "distinct": "30", "missing": "0", "min": "0", "max": "77", "mean": "0", "stdev": "0" }, { "name": "num_failed_logins", "index": "10", "type": "numeric", "distinct": "6", "missing": "0", "min": "0", "max": "5", "mean": "0", "stdev": "0" }, { "name": "logged_in", "index": "11", "type": "nominal", "distinct": "2", "missing": "0", "distr": [ [ "1", "0" ], [ [ "2203", "0", "8", "1", "5", "4", "57", "30", "6", "0", "1", "28", "4", "0", "0", "3", "1020", "0", "1", "2", "3", "699690", "1" ], [ "0", "979", "1", "1072016", "5", "0", "15835", "0", "2", "21", "1", "12453", "3", "2807886", "264", "0", "0", "2316", "11", "18", "10410", "273091", "52" ] ] ] }, { "name": "lnum_compromised", "index": "12", "type": "numeric", "distinct": "98", "missing": "0", "min": "0", "max": "7479", "mean": "0", "stdev": "4" }, { "name": "lroot_shell", "index": "13", "type": "numeric", "distinct": "2", "missing": "0", "min": "0", "max": "1", "mean": "0", "stdev": "0" }, { "name": "lsu_attempted", "index": "14", "type": "numeric", "distinct": "3", "missing": "0", "min": "0", "max": "2", "mean": "0", "stdev": "0" }, { "name": "lnum_root", "index": "15", "type": "numeric", "distinct": "93", "missing": "0", "min": "0", "max": "7468", "mean": "0", "stdev": "4" }, { "name": "lnum_file_creations", "index": "16", "type": "numeric", "distinct": "42", "missing": "0", "min": "0", "max": "43", "mean": "0", "stdev": "0" }, { "name": "lnum_shells", "index": "17", "type": "numeric", "distinct": "3", "missing": "0", "min": "0", "max": "2", "mean": "0", "stdev": "0" }, { "name": "lnum_access_files", "index": "18", "type": "numeric", "distinct": "10", "missing": "0", "min": "0", "max": "9", "mean": "0", "stdev": "0" }, { "name": "lnum_outbound_cmds", "index": "19", "type": "numeric", "distinct": "1", "missing": "0", "min": "0", "max": "0", "mean": "0", "stdev": "0" }, { "name": "is_host_login", "index": "20", "type": "nominal", "distinct": "2", "missing": "0", "distr": [ [ "1", "0" ], [ [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "2", "0" ], [ "2203", "979", "9", "1072017", "10", "4", "15892", "30", "8", "21", "2", "12481", "7", "2807886", "264", "3", "1020", "2316", "12", "20", "10413", "972779", "53" ] ] ] }, { "name": "is_guest_login", "index": "21", "type": "nominal", "distinct": "2", "missing": "0", "distr": [ [ "1", "0" ], [ [ "0", "0", "0", "0", "0", "0", "1", "0", "2", "0", "0", "0", "2", "0", "0", "0", "307", "0", "0", "2", "0", "3776", "1" ], [ "2203", "979", "9", "1072017", "10", "4", "15891", "30", "6", "21", "2", "12481", "5", "2807886", "264", "3", "713", "2316", "12", "18", "10413", "969005", "52" ] ] ] }, { "name": "count", "index": "22", "type": "numeric", "distinct": "512", "missing": "0", "min": "0", "max": "511", "mean": "335", "stdev": "212" }, { "name": "srv_count", "index": "23", "type": "numeric", "distinct": "512", "missing": "0", "min": "0", "max": "511", "mean": "295", "stdev": "246" }, { "name": "serror_rate", "index": "24", "type": "numeric", "distinct": "96", "missing": "0", "min": "0", "max": "1", "mean": "0", "stdev": "0" }, { "name": "srv_serror_rate", "index": "25", "type": "numeric", "distinct": "87", "missing": "0", "min": "0", "max": "1", "mean": "0", "stdev": "0" }, { "name": "rerror_rate", "index": "26", "type": "numeric", "distinct": "89", "missing": "0", "min": "0", "max": "1", "mean": "0", "stdev": "0" }, { "name": "srv_rerror_rate", "index": "27", "type": "numeric", "distinct": "76", "missing": "0", "min": "0", "max": "1", "mean": "0", "stdev": "0" }, { "name": "same_srv_rate", "index": "28", "type": "numeric", "distinct": "101", "missing": "0", "min": "0", "max": "1", "mean": "1", "stdev": "0" }, { "name": "diff_srv_rate", "index": "29", "type": "numeric", "distinct": "95", "missing": "0", "min": "0", "max": "1", "mean": "0", "stdev": "0" }, { "name": "srv_diff_host_rate", "index": "30", "type": "numeric", "distinct": "72", "missing": "0", "min": "0", "max": "1", "mean": "0", "stdev": "0" }, { "name": "dst_host_count", "index": "31", "type": "numeric", "distinct": "256", "missing": "0", "min": "0", "max": "255", "mean": "233", "stdev": "64" }, { "name": "dst_host_srv_count", "index": "32", "type": "numeric", "distinct": "256", "missing": "0", "min": "0", "max": "255", "mean": "189", "stdev": "106" }, { "name": "dst_host_same_srv_rate", "index": "33", "type": "numeric", "distinct": "101", "missing": "0", "min": "0", "max": "1", "mean": "1", "stdev": "0" }, { "name": "dst_host_diff_srv_rate", "index": "34", "type": "numeric", "distinct": "101", "missing": "0", "min": "0", "max": "1", "mean": "0", "stdev": "0" }, { "name": "dst_host_same_src_port_rate", "index": "35", "type": "numeric", "distinct": "101", "missing": "0", "min": "0", "max": "1", "mean": "1", "stdev": "0" }, { "name": "dst_host_srv_diff_host_rate", "index": "36", "type": "numeric", "distinct": "76", "missing": "0", "min": "0", "max": "1", "mean": "0", "stdev": "0" }, { "name": "dst_host_serror_rate", "index": "37", "type": "numeric", "distinct": "101", "missing": "0", "min": "0", "max": "1", "mean": "0", "stdev": "0" }, { "name": "dst_host_srv_serror_rate", "index": "38", "type": "numeric", "distinct": "100", "missing": "0", "min": "0", "max": "1", "mean": "0", "stdev": "0" }, { "name": "dst_host_rerror_rate", "index": "39", "type": "numeric", "distinct": "101", "missing": "0", "min": "0", "max": "1", "mean": "0", "stdev": "0" }, { "name": "dst_host_srv_rerror_rate", "index": "40", "type": "numeric", "distinct": "101", "missing": "0", "min": "0", "max": "1", "mean": "0", "stdev": "0" } ], "nr_of_issues": 0, "nr_of_downvotes": 0, "nr_of_likes": 0, "nr_of_downloads": 0, "total_downloads": 0, "reach": 0, "reuse": 0, "impact_of_reuse": 0, "reach_of_reuse": 0, "impact": 0 }