A detailed analysis of the KDD CUP 99 data set

Authors:
Mahbod Tavallaee;Ebrahim Bagheri;Wei Lu;Ali A. Ghorbani
Affiliations:
Faculty of Computer Science, University of New Brunswick, Fredericton, NB, Canada;Institute for Information Technology, National Research Council Canada;Faculty of Computer Science, University of New Brunswick, Fredericton, NB, Canada;Faculty of Computer Science, University of New Brunswick, Fredericton, NB, Canada
Venue:
CISDA'09 Proceedings of the Second IEEE international conference on Computational intelligence for security and defense applications
Year:
2009

Citing 11
Cited 24

C4.5: programs for machine learning

C4.5: programs for machine learning
A taxonomy of computer program security flaws

ACM Computing Surveys (CSUR)
The base-rate fallacy and the difficulty of intrusion detection

ACM Transactions on Information and System Security (TISSEC)
Testing Intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory

ACM Transactions on Information and System Security (TISSEC)
Random Forests

Machine Learning
Evaluation of Intrusion Detectors: A Decision Theory Approach

SP '01 Proceedings of the 2001 IEEE Symposium on Security and Privacy
Unsupervised anomaly detection in network intrusion detection using clusters

ACSC '05 Proceedings of the Twenty-eighth Australasian conference on Computer Science - Volume 38
Measuring intrusion detection capability: an information-theoretic approach

ASIACCS '06 Proceedings of the 2006 ACM Symposium on Information, computer and communications security
A Framework for the Evaluation of Intrusion Detection Systems

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Estimating continuous distributions in Bayesian classifiers

UAI'95 Proceedings of the Eleventh conference on Uncertainty in artificial intelligence
Towards a theory of intrusion detection

ESORICS'05 Proceedings of the 10th European conference on Research in Computer Security

MAWILab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking

Proceedings of the 6th International COnference
AI based supervised classifiers: an analysis for intrusion detection

ACAI '11 Proceedings of the International Conference on Advances in Computing and Artificial Intelligence
Decision tree based light weight intrusion detection using a wrapper approach

Expert Systems with Applications: An International Journal
A method for combining mutual information and canonical correlation analysis: Predictive Mutual Information and its use in feature selection

Expert Systems with Applications: An International Journal
A Composite Privacy Leakage Indicator

Wireless Personal Communications: An International Journal
Internet traffic classification using multifractal analysis approach

Proceedings of the 15th Communications and Networking Simulation Symposium
Network intrusion detection system: a machine learning approach

Intelligent Decision Technologies
An Optimum-Path Forest framework for intrusion detection in computer networks

Engineering Applications of Artificial Intelligence
Intelligent intrusion detection system using fuzzy rough set based C4.5 algorithm

Proceedings of the International Conference on Advances in Computing, Communications and Informatics
Securing advanced metering infrastructure using intrusion detection system with data stream mining

PAISI'12 Proceedings of the 2012 Pacific Asia conference on Intelligence and Security Informatics
Intrusion detection under covariate shift using modified support vector machine and modified backpropagation

Proceedings of the Third Symposium on Information and Communication Technology
A network intrusion detection system based on a Hidden Naïve Bayes multiclass classifier

Expert Systems with Applications: An International Journal
Application of bagging, boosting and stacking to intrusion detection

MLDM'12 Proceedings of the 8th international conference on Machine Learning and Data Mining in Pattern Recognition
IP v6 secure tunneling mechanism

Proceedings of the CUBE International Information Technology Conference
Improving an SVD-based combination strategy of anomaly detectors for traffic labelling

Proceedings of the Asian Internet Engineeering Conference
An ecological approach to anomaly detection: the EIA model

ICARIS'12 Proceedings of the 11th international conference on Artificial Immune Systems
New class-dependent feature transformation for intrusion detection systems

Security and Communication Networks
Extreme learning machines for intrusion detection systems

ICONIP'12 Proceedings of the 19th international conference on Neural Information Processing - Volume Part IV
An analysis of a spatial EA parallel boosting algorithm

Proceedings of the 15th annual conference on Genetic and evolutionary computation
An adaptive ensemble classifier for mining concept drifting data streams

Expert Systems with Applications: An International Journal
Evaluating performance of long short-term memory recurrent neural networks on intrusion detection data

Proceedings of the South African Institute for Computer Scientists and Information Technologists Conference
Data stream clustering: A survey

ACM Computing Surveys (CSUR)
A novel hybrid intrusion detection method integrating anomaly detection with misuse detection

Expert Systems with Applications: An International Journal
Hybrid decision tree and naïve Bayes classifiers for multi-class classification tasks

Expert Systems with Applications: An International Journal

Quantified Score

Hi-index	0.01

Visualization

Abstract

During the last decade, anomaly detection has attracted the attention of many researchers to overcome the weakness of signature-based IDSs in detecting novel attacks, and KDDCUP'99 is the mostly widely used data set for the evaluation of these systems. Having conducted a statistical analysis on this data set, we found two important issues which highly affects the performance of evaluated systems, and results in a very poor evaluation of anomaly detection approaches. To solve these issues, we have proposed a new data set, NSL-KDD, which consists of selected records of the complete KDD data set and does not suffer from any of mentioned shortcomings.