MAWILab

Data set: 2008/04/28






Traffic Trace: 2008/04/28

Info: http://mawi.wide.ad.jp/mawi/samplepoint-F/2008/200804281400.html
tcpdump file: http://mawi.wide.ad.jp/mawi/samplepoint-F/2008/200804281400.dump.gz

Anomalous Traffic:

"Anomalous" and "Suspicious" labels (admd file): 200804281400_anomalous_suspicious.xml

Overview of the anomalies:

# of anomalies: 37
# of anomalies as function of the # of alarms and # of detectors reporting the alarms:


Breakdown of the anomalies:

CategoryLabelDetectors
SYN scanAnomalous Hough, Gamma, PCA
Ping floodAnomalous Hough, Gamma
SYN scanAnomalous Hough, Gamma, KL, PCA
SYN scanAnomalous Gamma, KL, PCA
SYN scanSuspicious Gamma, KL
Ping floodSuspicious Gamma, KL, PCA
Ping floodSuspicious Gamma, KL
SYN scanSuspicious Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma, KL, PCA
HTTPSuspicious Gamma, KL, PCA
HTTPSuspicious Gamma, KL, PCA
HTTPSuspicious Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownSuspicious Hough
UnknownSuspicious Hough
UnknownSuspicious Hough, Gamma
UnknownSuspicious Gamma, KL, PCA
UnknownSuspicious Gamma, KL
UnknownSuspicious Gamma, KL, PCA
CategoryLabelDetectors

Other:

"Notice" labels (admd file): 200804281400_notice.xml