MAWILab

Data set: 2005/04/02






Traffic Trace: 2005/04/02

Info: http://mawi.wide.ad.jp/mawi/samplepoint-B/2005/200504021400.html
tcpdump file: http://mawi.wide.ad.jp/mawi/samplepoint-B/2005/200504021400.dump.gz

Anomalous Traffic:

"Anomalous" and "Suspicious" labels (admd file): 200504021400_anomalous_suspicious.xml

Overview of the anomalies:

# of anomalies: 112
# of anomalies as function of the # of alarms and # of detectors reporting the alarms:


Breakdown of the anomalies:

CategoryLabelDetectors
SasserAnomalous Hough, Gamma, KL
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
Ping floodAnomalous Hough, Gamma, PCA
SasserAnomalous Hough, Gamma, PCA
SYN scanAnomalous Hough, Gamma, KL, PCA
Ping floodAnomalous Hough, Gamma, KL
SasserAnomalous Hough, Gamma, PCA
SYN scanAnomalous Hough, Gamma, KL, PCA
NetbiosSuspicious Hough
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma
SasserSuspicious Hough, Gamma
SasserSuspicious Hough, PCA
SYN scanSuspicious Hough, PCA
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma
SYN scanSuspicious Hough, Gamma
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma
SasserSuspicious Hough, Gamma
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough
SasserSuspicious Hough, PCA
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma
SasserSuspicious Hough, Gamma
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma
SasserSuspicious Hough, Gamma
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, PCA
SasserSuspicious Hough, Gamma
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma, PCA
SYN scanSuspicious Hough, Gamma, PCA
SasserSuspicious Hough, Gamma, PCA
Ping floodSuspicious Hough, Gamma
SasserSuspicious Gamma, PCA
Ping floodSuspicious Gamma
SasserSuspicious Hough, PCA
SasserSuspicious Hough, PCA
SasserSuspicious Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma, KL, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma, KL, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPSuspicious Hough, Gamma
HTTPSuspicious Hough, Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Hough, Gamma
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
HTTPSuspicious Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Hough
UnknownSuspicious Gamma
UnknownSuspicious Gamma, KL
UnknownSuspicious Gamma, PCA
UnknownSuspicious Gamma, PCA
CategoryLabelDetectors

Other:

"Notice" labels (admd file): 200504021400_notice.xml