MAWILab

Data set: 2008/04/21






Traffic Trace: 2008/04/21

Info: http://mawi.wide.ad.jp/mawi/samplepoint-F/2008/200804211400.html
tcpdump file: http://mawi.wide.ad.jp/mawi/samplepoint-F/2008/200804211400.dump.gz

Anomalous Traffic:

"Anomalous" and "Suspicious" labels (admd file): 200804211400_anomalous_suspicious.xml

Overview of the anomalies:

# of anomalies: 46
# of anomalies as function of the # of alarms and # of detectors reporting the alarms:


Breakdown of the anomalies:

CategoryLabelDetectors
Ping floodAnomalous Gamma, KL, PCA
Ping floodAnomalous Gamma, KL, PCA
NetbiosAnomalous KL, PCA
SYN scanSuspicious Hough, Gamma, PCA
NetbiosSuspicious Hough, PCA
SYN scanSuspicious Hough, PCA
SYN scanSuspicious Hough, Gamma, PCA
SSHAnomalous Hough, Gamma, KL, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma, KL, PCA
HTTPAnomalous Hough, Gamma, KL, PCA
FTPAnomalous Hough, Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Hough, Gamma
HTTPSuspicious Hough, Gamma
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Hough, Gamma
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
HTTPSuspicious Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma
UnknownAnomalous Hough, Gamma
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Hough, Gamma
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownSuspicious Hough
UnknownSuspicious Hough
UnknownSuspicious Hough
UnknownSuspicious Hough, Gamma
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Hough, Gamma, PCA
UnknownSuspicious Hough, Gamma
UnknownSuspicious Hough, Gamma
CategoryLabelDetectors

Other:

"Notice" labels (admd file): 200804211400_notice.xml