Download: conn Zip File
| Number of Instances: | 197505 | Security Area: | Network Protocols |
|---|---|---|---|
| Number of Attributes: | 20 | Date Donated: | 2012 |
| Missing Values? | - | Associated ML Tasks: | Network Analysis |
Mike Sconzo
Security Repository
Secrepo.com
This script manages the tracking/logging of general information regarding TCP, UDP, and ICMP traffic. For UDP and ICMP, “connections” are to be interpreted using flow semantics (sequence of packets from a source host/port to a destination host/port). Further, ICMP “ports” are to be interpreted as the source port meaning the ICMP message type and the destination port being the ICMP message code.
| Data Type | Count | Unique Values | Missing Values | |
|---|---|---|---|---|
| ts | float64 | 197505 | 197505 | 0 |
| uid | object | 197505 | 197505 | 0 |
| id.orig_h | object | 197505 | 742 | 0 |
| id.orig_p | int64 | 197505 | 1899 | 0 |
| id.resp_h | object | 197505 | 30939 | 0 |
| id.resp_p | int64 | 197505 | 367 | 0 |
| proto | object | 197505 | 3 | 0 |
| service | object | 142486 | 8 | 55019 |
| duration | float64 | 173843 | 158065 | 23662 |
| orig_bytes | float64 | 173843 | 7050 | 23662 |
| resp_bytes | float64 | 173843 | 34275 | 23662 |
| conn_state | object | 197505 | 13 | 0 |
| local_orig | float64 | 0 | 0 | 197505 |
| missed_bytes | int64 | 197505 | 169 | 0 |
| history | object | 196420 | 312 | 1085 |
| orig_pkts | int64 | 197505 | 973 | 0 |
| orig_ip_bytes | int64 | 197505 | 11261 | 0 |
| resp_pkts | int64 | 197505 | 1299 | 0 |
| resp_ip_bytes | int64 | 197505 | 36451 | 0 |
| tunnel_parents | object | 197505 | 1 | 0 |
Bro Logs http://gauss.ececs.uc.edu/Courses/c6055/pdf/bro_log_vars.pdf
Neise, Patrick. "Intrusion Detection Through Relationship Analysis". Oct 2016 https://www.sans.org/reading-room/whitepapers/detection/intrusion-detection-relationship-analysis-37352
Frances Bernadette C. De Ocampo, Trisha Mari L. Del Castillo, Miguel Alberto N. Gomez. "AUTOMATED SIGNATURE CREATOR FOR A SIGNATURE BASED INTRUSION DETECTION SYSTEM WITH NETWORK ATTACK DETECTION CAPABILITIES". 2013 http://sdiwc.net/digital-library/automated-signature-creator-for-a-signature-based-intrusion-detection-system-with-network-attack-detection-capabilities-pancakes.html