Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation

By Richard P. Lippmann, D. Fried, Isaac Graf, Joshua W. Haines, K. Kendall, D. McClung, D. Weber, S. Webster, D. Wyschogrod, R. Cunningham and 1 more. Proceedings DARPA Information Survivability Conference and Exposition. DISCEX'00, 2000

1,144 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/5deeddbe6ef4082f8113aca3a4c4857280f93b62

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Data preprocessing for anomaly based network intrusion detection: A review (2011, methodology): “The dataset was generated from the DARPA 98 network traffic (Lippmann et al., 2000).”
Statistical fraud detection: A review (2002, background): “Lippmann et al. (2000) concluded that emphasis should be placed on developing methods for detecting new patterns of intrusion rather than old patterns, but Kumar and Spafford (1994) remarked that " a majority of break-ins . . . are the result of a small number of known attacks, as evidenced by…”
Use of K-Nearest Neighbor classifier for intrusion detection (2002, methodology): “The RSTCORP group [7] gave good performance during the evaluation of the 1998 DARPABSM data [15].”
Incremental Local Outlier Detection for Data Streams (2007, positive): “The third data set was 1998 DARPA Intrusion Detection Evaluation Data [ 31 ].”
A Survey of Network-based Intrusion Detection Data Sets (2019, neutral): “DARPA [55], [56], [77].”
Machine Learning and Deep Learning Methods for Cybersecurity (2018, methodology): “DARPA Intrusion Detection Data Sets [21], which are under the direction of DARPA and AFRL/SNHS, are collected and published by The Cyber Systems and Technology Group (formerly the DARPA Intrusion Detection Evaluation Group) of MIT Lincoln Laboratory for evaluating computer network intrusion…”
Intrusion detection in wireless ad-hoc networks (2000, neutral): “Defense Advanced Research Projects Agency) sponsored the first Intrusion Detection Evaluation to survey the state-of-the-art of research in intrusion detection [11].”
A Two-Layer Dimension Reduction and Two-Tier Classification Model for Anomaly-Based Intrusion Detection in IoT Backbone Networks (2019, background): “Although there are still known issues in the NSL-KDD dataset [53], this does not affect the application of the dataset in this research or the validity of the findings.”
Computer Intrusion: Detecting Masquerades (2001, methodology): “Lippmann et al. (2000) used ROC curves in their comparison of several intrusion detection systems based on pattern recognition.”
Traffic Anomaly Detection Using K-Means Clustering (2007, methodology): “Finally, we are going to evaluate the detection performance using reference data such as DARPA'98 traces [27] as well as real Internet traffic.”
Internet of Things (IoT) Security Intelligence: A Comprehensive Overview, Machine Learning Solutions and Research Directions (2022, neutral): “Hence, we have summarized as NSL-KDD [139], UNSW-NB15 [97], DARPA [147] [85], CAIDA [4] [3], ISOT’10 [14] [13], ISCX’12 [5] [128], CTU-13 [10], CICIDS [9], CIC-DDoS2019 [6], MAWI [64], ADFA IDS”
Internet intrusions: global characteristics and prevalence (2003, result): “Other well known studies related to ours are the DARPA Intrusion Data Sets from 1998 and 1999 [13].”
A Novel Anomaly Detection Scheme Based on Principal Component Classifier (2003, methodology): “A comparative study of these schemes on DARPA 1998 data set indicated that the most promising technique was the LOF approach [18].”
Multivariate Statistical Analysis of Audit Trails for Host-Based Intrusion Detection (2002, methodology): “Normal activities are simulated by the MIT Lincoln Laboratory according to normal activities observed in a real-world computer and network system [ 3 ].”
A framework for the evaluation of intrusion detection systems (2006, methodology): “Mainly the ROC curve describing the performance of the COLUMBIA team intrusion detector for the 1998 DARPA intrusion detection evaluation [18].”