MAWILab

Home Data set Documentation Contribution Contact

2001

2002

2003

2004

2005

2006

2007

2008

2009

2010

2011

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Traffic Trace: 2005/02/23

Info: http://mawi.wide.ad.jp/mawi/samplepoint-B/2005/200502231400.html
tcpdump file: http://mawi.wide.ad.jp/mawi/samplepoint-B/2005/200502231400.dump.gz

Anomalous Traffic:

"Anomalous" and "Suspicious" labels (admd file): 200502231400_anomalous_suspicious.xml

Overview of the anomalies:

# of anomalies: 307
# of anomalies as function of the # of alarms and # of detectors reporting the alarms:

Breakdown of the anomalies:

Category	Label	Detectors
Sasser	Anomalous	Hough, Gamma, PCA
Netbios	Anomalous	Hough, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, PCA
Sasser	Anomalous	Hough, KL, PCA
Sasser	Anomalous	Hough, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, PCA
Sasser	Anomalous	Hough, Gamma
SYN scan	Anomalous	Hough, Gamma, KL
Sasser	Anomalous	Hough, Gamma
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma
Ping flood	Anomalous	Hough, Gamma
Sasser	Anomalous	Hough, PCA
Sasser	Anomalous	Hough, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, KL
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
SYN scan	Anomalous	Hough, Gamma, PCA
SYN scan	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
Sasser	Anomalous	Hough, Gamma, PCA
SYN scan	Anomalous	Hough, Gamma, KL
Sasser	Anomalous	Hough, Gamma, KL
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL, PCA
Sasser	Anomalous	Hough, Gamma, KL
Sasser	Anomalous	Hough, PCA
SYN scan	Anomalous	Gamma, KL, PCA
Netbios	Anomalous	Gamma, KL, PCA
SYN scan	Anomalous	Gamma, KL, PCA
Netbios	Anomalous	Hough, PCA
Netbios	Suspicious	Hough
Netbios	Suspicious	Hough, PCA
Netbios	Suspicious	Hough
Netbios	Suspicious	Hough, PCA
Netbios	Suspicious	Hough
Netbios	Suspicious	Hough, PCA
Sasser	Suspicious	Hough
Sasser	Suspicious	Hough, Gamma
Sasser	Suspicious	Hough, Gamma
SYN scan	Suspicious	Hough
Sasser	Suspicious	Hough, Gamma
Sasser	Suspicious	Hough, Gamma
Sasser	Suspicious	Hough, PCA
Ping flood	Suspicious	Hough
Netbios	Suspicious	Hough, PCA
Netbios	Suspicious	Hough
Netbios	Suspicious	Hough
Sasser	Suspicious	Hough, Gamma
Sasser	Suspicious	Hough, Gamma
Ping flood	Suspicious	Hough
RST scan	Suspicious	Gamma, PCA
Sasser	Suspicious	Hough, Gamma, PCA
Ping flood	Suspicious	Gamma, PCA
Sasser	Suspicious	Hough, Gamma, PCA
Sasser	Suspicious	Hough, Gamma, PCA
Sasser	Suspicious	Hough, Gamma, PCA
Ping flood	Suspicious	Hough, Gamma, PCA
RST scan	Suspicious	Gamma, PCA
Ping flood	Suspicious	Gamma
SYN scan	Suspicious	Gamma, PCA
Sasser	Suspicious	Hough, Gamma, PCA
Sasser	Suspicious	Hough, Gamma, PCA
RST scan	Suspicious	Gamma, PCA
Ping flood	Suspicious	Gamma
SYN scan	Suspicious	Gamma, PCA
Ping flood	Suspicious	Gamma
Netbios	Suspicious	Hough, PCA
Sasser	Suspicious	Gamma, PCA
Netbios	Suspicious	Hough, PCA
Netbios	Suspicious	PCA
Netbios	Suspicious	PCA
Netbios	Suspicious	PCA
Ping flood	Suspicious	PCA
Sasser	Suspicious	PCA
Netbios	Suspicious	PCA
Netbios	Suspicious	PCA
Sasser	Suspicious	Hough, PCA
Sasser	Suspicious	Hough, PCA
Sasser	Suspicious	PCA
Netbios	Suspicious	PCA
HTTP	Anomalous	Hough, Gamma, KL, PCA
HTTP	Anomalous	Hough, Gamma, KL, PCA
HTTP	Anomalous	Hough, Gamma
HTTP	Anomalous	Hough, Gamma, PCA
HTTP	Anomalous	Gamma, KL, PCA
HTTP	Anomalous	Gamma, KL, PCA
HTTP	Anomalous	Hough, Gamma, PCA
HTTP	Suspicious	Hough, Gamma
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Hough, Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Hough, Gamma
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Hough, Gamma
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Hough, Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTPS	Suspicious	Hough, Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Hough, Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Hough, Gamma
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Hough, Gamma
HTTP	Suspicious	Hough, Gamma
HTTP	Suspicious	Hough, Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Hough, Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
FTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Hough, Gamma
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
FTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma
HTTP	Suspicious	Gamma
HTTP	Suspicious	Gamma
HTTP	Suspicious	Gamma
HTTP	Suspicious	Hough, Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTPS	Suspicious	Hough, Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	PCA
HTTP	Suspicious	PCA
HTTP	Suspicious	PCA
HTTP	Suspicious	PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	PCA
HTTP	Suspicious	Gamma, PCA
HTTP	Suspicious	PCA
Unknown	Anomalous	Hough, Gamma
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, KL, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, PCA
Unknown	Anomalous	Hough, Gamma, KL
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, KL, PCA
Unknown	Anomalous	Hough, Gamma
Unknown	Anomalous	Hough, Gamma, KL
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, KL, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, KL, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma
Unknown	Anomalous	Gamma, KL, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, KL, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Hough, Gamma, PCA
Unknown	Anomalous	Gamma, KL
Unknown	Anomalous	Gamma, KL, PCA
Unknown	Anomalous	Gamma, KL, PCA
Unknown	Anomalous	Hough, Gamma, KL, PCA
Unknown	Anomalous	Hough, Gamma, KL, PCA
Unknown	Anomalous	Hough, Gamma, KL
Unknown	Anomalous	Gamma, KL
Unknown	Suspicious	Hough, Gamma, PCA
Unknown	Suspicious	Hough, Gamma
Unknown	Suspicious	Hough, Gamma
Unknown	Suspicious	Hough, PCA
Unknown	Suspicious	Hough
Unknown	Suspicious	Gamma
Unknown	Suspicious	Hough, Gamma
Unknown	Suspicious	Gamma
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Hough, Gamma
Unknown	Suspicious	Hough, Gamma
Unknown	Suspicious	Hough, Gamma, PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Hough, Gamma
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Hough, Gamma
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Hough, Gamma
Unknown	Suspicious	Gamma
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Gamma
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Hough, Gamma, PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Gamma
Unknown	Suspicious	Gamma
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	PCA
Unknown	Suspicious	PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	PCA
Unknown	Suspicious	PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	PCA
Unknown	Suspicious	Gamma, PCA
Unknown	Suspicious	PCA
Unknown	Suspicious	Gamma, PCA
Category	Label	Detectors

Other:

"Notice" labels (admd file): 200502231400_notice.xml