5

I am looking for data sets published by researchers or freelancers which can be used for the purpose of IDS/IPS testing and evaluations. The data sets may be for portscans, DoS attacks, Remote to Local attacks, User to root attacks, or all of them. The bigger, the better.

Something on the lines of DARPA Intrusion Detection Evaluation Data set will exactly suit my needs. (http://www.ll.mit.edu/mission/communications/ist/corpora/ideval/data/index.html)

Improve this question
5
  • 2
    The IDS research community strongly discourages the use of the DARPA (and the derived KDD Cup) data set for any meaningful research. In general, it is non-trivial to generate such data sets: icir.org/vern/cs261n/papers/TISSEC-mchugh-critique.pdf.
    – mavam
    Commented May 23, 2012 at 9:38
  • Thanks a lot @MatthiasVallentin . But please do offer some alternatives to me then...
    – pnp
    Commented May 23, 2012 at 9:43
  • Unfortunately I am not aware of any reasonable public data sets precisely because they are so difficult to create in the first place. For a NIDS, you could start with traffic traces of known attacks, but be aware that this is quite an isolated setting closer to unit testing. At a broader scope, it's highly valuable to evaluate IDSs in multiple environments and understanding why does it perform as it does, as complex detection algorithms may not always give an obvious answer to this question.
    – mavam
    Commented May 23, 2012 at 15:29
  • @pnp, Hi, did you find your pcap datasets? I need some of them for my researches, thanks in advance
    – CDominik
    Commented Oct 6, 2015 at 10:16
  • @DomenicoChiarito Answers below (Yohann and pds) were helpful for me. This might also help you - mcfp.weebly.com
    – pnp
    Commented Oct 7, 2015 at 11:29

3 Answers 3

Reset to default
6

There is some repositories of pcap traces. Some have traces of malware, port scanning, etc.. You can then replay these traces with tcpreplay.

Improve this answer
3
  • Thanks for the links Yohann (+1 for that). They will surely help, although i am looking for larger data sets covering a broader range of attacks. And can you tell of some other tools i can use apart from tcpreplay for this purpose?
    – pnp
    Commented May 23, 2012 at 7:20
  • If you have money, there is commercial product like Breaking Point.
    – Yohann
    Commented May 23, 2012 at 9:45
  • Thanks a ton Yohann...my guide is quite happy with my 'findings'. If you have got some more information then surely do let me know...
    – pnp
    Commented May 26, 2012 at 9:14
4

For a dataset to assist the evaluation of IDS / IPS systems, I recommend you the following:

  • ISCX 2012 dataset, collected in 2010 as a replacement for KDDCup99. The dataset has network packet filtering (NPF) attributes; it does not include KDDCup99's more expansive SIEM logging system data. Fortunately, it is labelled.

  • ITOC 2009 dataset has added NPF and audit logging data, but is devoid of labels. Some work exists to evaluate it using Snort IDS.

Other replacements to KDDCup99 are out there, such as NSL-KDD, see Quora answer for links.

As for Web-Pen testing dataset, as Schroeder mentions, here is one:

  • CSIC 2010 dataset is an HTTP web penetration testing dataset intended for anomaly detection and created by the ISI CSIC in 2010
Improve this answer
2

Have you looked at vSploit from Metasploit? You set up a vSploit server inside your network, then a vSploit client outside. It is designed to perform the types of testing you are looking for, although I do not know if the full set of traffic is as comprehensive as you are looking for.

I'd be interested to know what you do think of their data set!

Improve this answer
1
  • Thanks a lot schroeder. It will take me some time to actually understand how to use vSploit, but surely it is going to be a good help to me. If you are aware of some learning material on it apart from the Defcon video on it, i shall be glad to know about it.
    – pnp
    Commented May 26, 2012 at 9:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .