An analysis of the 1999 DARPA/lincoln Laboratory evaluation data for network anomaly detection

摘要: The DARPA/MIT Lincoln Laboratory off-line intrusion detection evaluation data set is the most widely used public benchmark for testing systems. Our investigation of 1999 background network traffic suggests presence simulation artifacts that would lead to overoptimistic anomaly effect can be mitigated without knowledge specific by mixing real into simulation, although method requires both system and analyzed possibly modified ensure does not model simulated independently traffic.