Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

In KDD CUP'99 there are time-based features calculated in last 2 seconds. But in the dataset there is only on record for a 8000 seconds long telnet connection. Shouldn't there exists a record for each packet received during that telnet connection?

Why time-based features are defined if there are not in use? The same is true for connection-based features which are calculated for last 100 connections.

In other words, KDD CUP'99 is offline. Each record represents a closed connection. If one trys to calculated the same features, but online, on DARPA 1998 dataset, will he get better results? for example, could he flag a telnet connection as attack at second 2312, that otherwise couldn't be detected at end of connection as it is the case in KDD CUP dataset.

I am aware that using KDD CUP'99 dataset is not recommended. But my question is about the features not the dataset. Also, I asked the same question here in different form, but it got closed.

Thanks.

share|improve this question
The KDD CUP'99 dataset is absolutely horrible; it's not just the data that's bad, it's everything about it, including the the time-based features and other calculations. It's completely out of touch with modern DoS attacks and our current understanding of how they work / can be protected against. There's a reason we keep closing your questions about it - nobody else uses it, and it doesn't help solve any current or useful security problems. It's like asking about a WW2 tank on a car mechanics forum. – Polynomial Dec 5 '12 at 11:27
Thanks. There are about 40 papers during 2000-2007 using KDD CUP'99. I want to know why they have used it and not getting concerned about my question. I guess I have some misunderstanding regard it. I want to know what is my problem. By the way, the papers in 2012 are still using KDD CUP'99. I searched a lot for other features to use, I just found a little. I want to see If it is reasonable to use some features of KDD CUP'99 or not. – Yasser MZadeh Dec 5 '12 at 11:37
I asked for relevant features here, and no one answered me. – Yasser MZadeh Dec 5 '12 at 11:49
Sadly, academia has little to do with real life. – Polynomial Dec 5 '12 at 11:56
Hi Yasser - this is a very limited question, and in fact the CUP'99 is not thought to be relevant to a security professional. Additionally, the question "why does this exist" is not something likely to be answerable by anyone other than those involved with the project. Closed as 'Too Localised' – Rory Alsop♦ Dec 5 '12 at 15:46

closed as too localized by Polynomial, schroeder, Rory Alsop♦ Dec 5 '12 at 15:45

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, see the FAQ.

Browse other questions tagged or ask your own question.