Download: notice Zip File
| Number of Instances: | 1973 | Security Area: | Detection |
|---|---|---|---|
| Number of Attributes: | 26 | Date Donated: | 2012 |
| Missing Values? | - | Associated ML Tasks: | Network Analysis |
Mike Sconzo
Security Repository
Secrepo.com
This is the notice framework which enables Bro to “notice” things which are odd or potentially bad. Decisions of the meaning of various notices need to be done per site because Bro does not ship with assumptions about what is bad activity for sites. More extensive documentation about using the notice framework can be found in Notice Framework.
| Data Type | Count | Unique Values | Missing Values | |
|---|---|---|---|---|
| ts | float64 | 1973 | 1825 | 0 |
| uid | object | 1944 | 1607 | 29 |
| id.orig_h | object | 1944 | 127 | 29 |
| id.orig_p | float64 | 1944 | 147 | 29 |
| id.resp_h | object | 1944 | 474 | 29 |
| id.resp_p | float64 | 1944 | 11 | 29 |
| fuid | object | 1928 | 1928 | 45 |
| file_mime_type | object | 1928 | 5 | 45 |
| file_desc | object | 1928 | 1383 | 45 |
| proto | object | 1973 | 1 | 0 |
| note | object | 1973 | 3 | 0 |
| msg | object | 1973 | 668 | 0 |
| sub | object | 1973 | 646 | 0 |
| src | object | 1973 | 127 | 0 |
| dst | object | 1944 | 474 | 29 |
| p | int64 | 1973 | 16 | 0 |
| n | float64 | 0 | 0 | 1973 |
| peer_descr | object | 1973 | 1 | 0 |
| actions | object | 1973 | 1 | 0 |
| suppress_for | float64 | 1973 | 1 | 0 |
| dropped | object | 1973 | 1 | 0 |
| remote_location.country_code | float64 | 0 | 0 | 1973 |
| remote_location.region | float64 | 0 | 0 | 1973 |
| remote_location.city | float64 | 0 | 0 | 1973 |
| remote_location.latitude | float64 | 0 | 0 | 1973 |
| remote_location.longitude | float64 | 0 | 0 | 1973 |
Bro Logs http://gauss.ececs.uc.edu/Courses/c6055/pdf/bro_log_vars.pdf
Neise, Patrick. "Intrusion Detection Through Relationship Analysis". Oct 2016 https://www.sans.org/reading-room/whitepapers/detection/intrusion-detection-relationship-analysis-37352
Frances Bernadette C. De Ocampo, Trisha Mari L. Del Castillo, Miguel Alberto N. Gomez. "AUTOMATED SIGNATURE CREATOR FOR A SIGNATURE BASED INTRUSION DETECTION SYSTEM WITH NETWORK ATTACK DETECTION CAPABILITIES". 2013 http://sdiwc.net/digital-library/automated-signature-creator-for-a-signature-based-intrusion-detection-system-with-network-attack-detection-capabilities-pancakes.html