MAWILab

Data set: 2004/10/14






Traffic Trace: 2004/10/14

Info: http://mawi.wide.ad.jp/mawi/samplepoint-B/2004/200410141400.html
tcpdump file: http://mawi.wide.ad.jp/mawi/samplepoint-B/2004/200410141400.dump.gz

Anomalous Traffic:

"Anomalous" and "Suspicious" labels (admd file): 200410141400_anomalous_suspicious.xml

Overview of the anomalies:

# of anomalies: 37
# of anomalies as function of the # of alarms and # of detectors reporting the alarms:


Breakdown of the anomalies:

CategoryLabelDetectors
SYN scanAnomalous Hough, Gamma
SasserAnomalous Hough
SasserAnomalous Hough, Gamma, KL, PCA
SasserAnomalous Hough, Gamma, PCA
SYN scanAnomalous Hough, Gamma, KL, PCA
SYN scanAnomalous Hough, Gamma, KL, PCA
SasserAnomalous KL, PCA
SasserSuspicious Hough
SasserSuspicious Hough
SYN scanSuspicious Hough
SasserSuspicious Hough
Ping floodSuspicious Gamma
SYN scanSuspicious Hough, Gamma
SYN scanSuspicious Gamma, KL, PCA
SYN scanSuspicious Hough, Gamma
SYN scanSuspicious Hough, Gamma
Ping floodSuspicious Gamma, PCA
SYN scanSuspicious Gamma, KL, PCA
SasserSuspicious Hough, PCA
SasserSuspicious KL, PCA
SasserSuspicious Hough, PCA
SasserSuspicious KL, PCA
NetbiosSuspicious Gamma, KL, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
UnknownSuspicious Hough, Gamma
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma
UnknownSuspicious Gamma, KL, PCA
CategoryLabelDetectors

Other:

"Notice" labels (admd file): 200410141400_notice.xml