Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am looking for data sets published by researchers or freelancers which can be used for the purpose of IDS/IPS testing and evaluations. The data sets may be for portscans, DoS attacks, Remote to Local attacks, User to root attacks, or all of them. The bigger, the better.

Something on the lines of DARPA Intrusion Detection Evaluation Data set will exactly suit my needs. (http://www.ll.mit.edu/mission/communications/ist/corpora/ideval/data/index.html)

share|improve this question
1  
The IDS research community strongly discourages the use of the DARPA (and the derived KDD Cup) data set for any meaningful research. In general, it is non-trivial to generate such data sets: icir.org/vern/cs261n/papers/TISSEC-mchugh-critique.pdf. –  Matthias Vallentin May 23 '12 at 9:38
    
Thanks a lot @MatthiasVallentin . But please do offer some alternatives to me then... –  pnp May 23 '12 at 9:43
    
Unfortunately I am not aware of any reasonable public data sets precisely because they are so difficult to create in the first place. For a NIDS, you could start with traffic traces of known attacks, but be aware that this is quite an isolated setting closer to unit testing. At a broader scope, it's highly valuable to evaluate IDSs in multiple environments and understanding why does it perform as it does, as complex detection algorithms may not always give an obvious answer to this question. –  Matthias Vallentin May 23 '12 at 15:29

3 Answers 3

up vote 4 down vote accepted

There is some repositories of pcap traces. Some have traces of malware, port scanning, etc.. You can then replay these traces with tcpreplay.

share|improve this answer
    
Thanks for the links Yohann (+1 for that). They will surely help, although i am looking for larger data sets covering a broader range of attacks. And can you tell of some other tools i can use apart from tcpreplay for this purpose? –  pnp May 23 '12 at 7:20
    
If you have money, there is commercial product like Breaking Point. –  Yohann May 23 '12 at 9:45
    
Thanks a ton Yohann...my guide is quite happy with my 'findings'. If you have got some more information then surely do let me know... –  pnp May 26 '12 at 9:14

For a dataset to assist the evaluation of IDS / IPS systems, I recommend you the following:

  • http://iscx.ca/dataset ISCX 2012 dataset, collected in 2010 as a replacement for KDDCup99. The dataset has network packet filtering (NPF) attributes; it does not include KDDCup99's more expansive SIEM logging system data. Fortunately, it is labelled.

  • https://www.itoc.usma.edu/research/dataset/ ITOC 2009 dataset has added NPF and audit logging data, but is devoid of labels. Some work exists to evaluate it using Snort IDS.

Other replacements to KDDCup99 are out there, such as NSL-KDD.

As for Web-Pen testing dataset, as Schroeder mentions, here is one:

  • iec.csic.es/dataset/ <-- Link (limited to max 2 URLs) CSIC 2010 dataset is a small (localhost) HTTP web penetration testing dataset. It was intended for anomaly detection and has relatively few unique instances. This tends to skew results somewhat. There is a CSV version of the dataset here: users.aber.ac.uk/pds7/csic_dataset/csic2010http.html <-- Link

HTH.

share|improve this answer

Have you looked at vSploit from Metasploit? You set up a vSploit server inside your network, then a vSploit client outside. It is designed to perform the types of testing you are looking for, although I do not know if the full set of traffic is as comprehensive as you are looking for.

I'd be interested to know what you do think of their data set!

share|improve this answer
    
Thanks a lot schroeder. It will take me some time to actually understand how to use vSploit, but surely it is going to be a good help to me. If you are aware of some learning material on it apart from the Defcon video on it, i shall be glad to know about it. –  pnp May 26 '12 at 9:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.