Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

In KDD CUP'99 dataset, "flag" feature refers to "normal or error status of the connection", which should changes as the TCP connection state changes. However in the training dataset it refers to the finished connection (improperly or properly).

Is training intrusion detection system (IPS, not IDS) with this data, makes the prevention (not just detection) process of online traffic impossible with respect to this feature, I mean blocking anomaly intrusion, which is useless if connection is already finished?

I am trying to see if IPS, not IDS, could be trained with KDD CUP'99 dataset to block anomaly-based intrusions.

Thanks.

share|improve this question
Can you please clarify what the issue you are trying to solve here is. – Rory Alsop♦ Nov 12 '12 at 22:34
I am trying to see if IPS, and not IDS, with anomaly based intrusion detection would work if I train it with KDD CUP'99 dataset, regarding the fact that in KDD CUP'99 the "flag" feature is calculated when the connection has finished (properly or improperly), while on online prevention the connection state is different. – Yasser MZadeh Nov 13 '12 at 6:58
2  
KDD CUP data is bad, as was pointed out in a response to your other question. – Vitaly Osipov Nov 14 '12 at 3:16

closed as not a real question by D.W., AviD♦ Nov 14 '12 at 10:15

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

Browse other questions tagged or ask your own question.