MAWILab

Data set: 2010/10/18






Traffic Trace: 2010/10/18

Info: http://mawi.wide.ad.jp/mawi/samplepoint-F/2010/201010181400.html
tcpdump file: http://mawi.wide.ad.jp/mawi/samplepoint-F/2010/201010181400.dump.gz

Anomalous Traffic:

"Anomalous" and "Suspicious" labels (admd file): 201010181400_anomalous_suspicious.xml

Overview of the anomalies:

# of anomalies: 45
# of anomalies as function of the # of alarms and # of detectors reporting the alarms:


Breakdown of the anomalies:

CategoryLabelDetectors
SYN scanAnomalous Hough, Gamma, PCA
SYN scanAnomalous Hough, Gamma, PCA
SYN scanAnomalous Hough, Gamma, KL
SYN scanAnomalous Hough, Gamma, PCA
SYN scanAnomalous Hough, Gamma, KL, PCA
Ping floodSuspicious Hough, Gamma
SYN scanSuspicious KL, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma
HTTPAnomalous Hough, Gamma, PCA
HTTPAnomalous Hough, Gamma, KL, PCA
HTTPAnomalous Gamma, KL, PCA
HTTPAnomalous Gamma, KL, PCA
HTTPAnomalous Hough, Gamma, KL, PCA
SSHAnomalous Gamma, KL, PCA
HTTPAnomalous Hough, Gamma, KL, PCA
HTTPSuspicious Hough, Gamma
HTTPSuspicious Hough, PCA
HTTPSuspicious Gamma, KL, PCA
UnknownAnomalous Hough, Gamma, KL
UnknownAnomalous Hough, Gamma
UnknownAnomalous Hough, Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL, PCA
UnknownAnomalous Gamma, KL
UnknownSuspicious Hough
UnknownSuspicious Gamma, KL, PCA
UnknownSuspicious Gamma, KL
UnknownSuspicious Gamma, KL, PCA
UnknownSuspicious Gamma, KL, PCA
UnknownSuspicious Gamma, KL, PCA
UnknownSuspicious Gamma, KL, PCA
UnknownSuspicious Gamma, KL, PCA
UnknownSuspicious Gamma, KL, PCA
CategoryLabelDetectors

Other:

"Notice" labels (admd file): 201010181400_notice.xml