Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am researching on Anomaly Intrusion Detection to implement one. At this phase, I am searching for relevant features to network traffic.

I found 41 features from KDD CUP'99 project (the paper: WENKE LEE, SALVATORE J. STOLFO, "A Framework for Constructing Features and Models for Intrusion Detection Systems") and many papers on how to do feature selection to reduce them and find most relevant ones. I also learned PHAD uses 34 features from the HEADERs.

Are there any other relevant traffic features to let the classification algorithms to detect the anomalies more precisely? I learned about 200 features somewhere but not the details.

Thanks.

EDIT: I found a great survey paper on this, "Jonathan J. Davis, Andrew J. Clark, Data preprocessing for anomaly based network intrusion detection: A review, 2011". Several features are listed as tables in its appendix.

share|improve this question
3  
The security community highly discourages the use of the DARPA data set (and the derived KDD CUP) for any meaningful research. I recommend reading John McHugh's critique and Robin Sommer's paper on this topic. –  Matthias Vallentin Nov 11 '12 at 5:41
    
So is there any other labeled traffic to evaluate my IDS? –  Yas Nov 11 '12 at 7:26
    
The HTTP dataset CSIC 2010 contains thousands of web requests automatically generated for analyzing web application security. –  Ali Ahmad Nov 11 '12 at 17:36
1  
This book talks of relevant features Statistical Techniques for Network Security –  Tate Hansen Nov 11 '12 at 21:23
    
Thanks. Although I don't have access to this book. –  Yas Nov 12 '12 at 10:02
add comment

1 Answer

up vote 0 down vote accepted

I found a great survey paper on this, "Jonathan J. Davis, Andrew J. Clark, Data preprocessing for anomaly based network intrusion detection: A review, 2011". Several features are listed as tables in its appendix.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.