MAWILab

Data set: 2003/04/29






Traffic Trace: 2003/04/29

Info: http://mawi.wide.ad.jp/mawi/samplepoint-B/2003/200304291400.html
tcpdump file: http://mawi.wide.ad.jp/mawi/samplepoint-B/2003/200304291400.dump.gz

Anomalous Traffic:

"Anomalous" and "Suspicious" labels (admd file): 200304291400_anomalous_suspicious.xml

Overview of the anomalies:

# of anomalies: 590
# of anomalies as function of the # of alarms and # of detectors reporting the alarms:


Breakdown of the anomalies:

CategoryLabelDetectors
NetbiosAnomalous Hough, Gamma, PCA
SYN scanAnomalous Hough, Gamma, KL
NetbiosAnomalous Hough, PCA
NetbiosAnomalous Hough, PCA
NetbiosAnomalous Hough, PCA
NetbiosAnomalous Hough, PCA
NetbiosAnomalous Hough, PCA
SYN scanAnomalous Hough, Gamma, PCA
Ping floodAnomalous Hough
SYN scanAnomalous Hough, Gamma
NetbiosAnomalous Hough, PCA
NetbiosAnomalous Hough, PCA
NetbiosAnomalous Hough
NetbiosAnomalous Hough
SYN scanAnomalous Hough
Ping floodAnomalous Hough
SYN scanAnomalous Hough, Gamma, PCA
SYN scanAnomalous Hough, Gamma, KL, PCA
SYN scanAnomalous Hough, Gamma, PCA
RST scanAnomalous Hough, Gamma, PCA
Scan HTTPAnomalous Hough, Gamma, KL, PCA
Ping floodAnomalous Hough, Gamma, PCA
SYN scanAnomalous Hough, Gamma, PCA
Ping floodAnomalous Gamma, PCA
NetbiosAnomalous Hough, KL, PCA
NetbiosAnomalous Hough, KL, PCA
Ping floodAnomalous Gamma, PCA
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough
Ping floodSuspicious Hough
Ping floodSuspicious Hough
Ping floodSuspicious Hough
Ping floodSuspicious Hough
Ping floodSuspicious Hough
Ping floodSuspicious Hough
Ping floodSuspicious Hough
Ping floodSuspicious Hough
Ping floodSuspicious Hough
Ping floodSuspicious Hough
NetbiosSuspicious Hough
NetbiosSuspicious Hough, PCA
SYN scanSuspicious Hough, Gamma, PCA
Ping floodSuspicious Gamma, PCA
RST scanSuspicious Gamma
Ping floodSuspicious Gamma, PCA
SYN scanSuspicious Gamma
NetbiosSuspicious Gamma
Ping floodSuspicious Gamma, PCA
Ping floodSuspicious Gamma
SYN scanSuspicious Gamma
Ping floodSuspicious Gamma
Ping floodSuspicious Gamma, PCA
Ping floodSuspicious Gamma
SYN scanSuspicious Gamma
Ping floodSuspicious Gamma
SYN scanSuspicious Gamma, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
SYN scanSuspicious Gamma, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
Ping floodSuspicious Gamma, PCA
NetbiosSuspicious Hough, PCA
Ping floodSuspicious Gamma, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
Ping floodSuspicious Gamma, PCA
NetbiosSuspicious Hough, PCA
Ping floodSuspicious Gamma, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious PCA
RST scanSuspicious PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
RST scanSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious PCA
RST scanSuspicious Gamma, PCA
NetbiosSuspicious PCA
Scan HTTPSuspicious Gamma, PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
Ping floodSuspicious PCA
NetbiosSuspicious PCA
Ping floodSuspicious Gamma, PCA
Ping floodSuspicious Gamma, PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious Hough, PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious PCA
NetbiosSuspicious Hough, PCA
SYN scanSuspicious Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma
HTTPAnomalous Hough, Gamma
HTTPAnomalous Hough
SSHAnomalous Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
FTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Gamma, PCA
HTTPAnomalous Gamma, PCA
HTTPAnomalous Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
FTPAnomalous Gamma, PCA
HTTPAnomalous Gamma, PCA
HTTPAnomalous Gamma, PCA
HTTPAnomalous Gamma, PCA
HTTPAnomalous Gamma, PCA
HTTPAnomalous Gamma, PCA
HTTPAnomalous Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPSuspicious Hough
HTTPSSuspicious Hough
HTTPSuspicious Hough
HTTPSuspicious Hough
HTTPSuspicious Hough, PCA
HTTPSuspicious Hough, Gamma
HTTPSuspicious Gamma
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Gamma
SSHSuspicious Hough, Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Hough, Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Hough, Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Hough, Gamma
HTTPSSuspicious Hough
HTTPSSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
SSHSuspicious Gamma
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Hough, PCA
HTTPSSuspicious Hough, Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Hough, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious Gamma, PCA
HTTPSSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
FTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious Hough, PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious PCA
HTTPSuspicious Hough, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious PCA
HTTPSuspicious PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, PCA
UnknownAnomalous Hough
UnknownAnomalous Hough
UnknownAnomalous Hough
UnknownAnomalous Hough
UnknownAnomalous Hough
UnknownAnomalous Hough
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Hough, Gamma
UnknownAnomalous Hough, Gamma
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Hough, Gamma
UnknownAnomalous Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownSuspicious Hough
UnknownSuspicious Hough
UnknownSuspicious Hough
UnknownSuspicious Hough
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Hough
UnknownSuspicious Hough
UnknownSuspicious Hough
UnknownSuspicious Hough
UnknownSuspicious Hough
UnknownSuspicious Hough
UnknownSuspicious Hough
UnknownSuspicious Hough
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Hough, Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Hough, Gamma
UnknownSuspicious Gamma
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Hough
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Hough, Gamma
UnknownSuspicious Hough, Gamma
UnknownSuspicious Gamma
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Hough, Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Hough, Gamma
UnknownSuspicious Gamma
UnknownSuspicious Hough, Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Hough, Gamma
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Hough, Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Hough, Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Hough, Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Hough, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious PCA
UnknownSuspicious PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Hough, PCA
UnknownSuspicious PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Hough, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious PCA
UnknownSuspicious PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious PCA
UnknownSuspicious Gamma, PCA
CategoryLabelDetectors

Other:

"Notice" labels (admd file): 200304291400_notice.xml