The 1999 DARPA off-line intrusion detection evaluation

By Richard P. Lippmann, Joshua W. Haines, D. Fried, J. Korba, K. Das. Comput. Networks, 2000

1,014 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/b2487cccd5bd584d8b05e97da4592370386b605f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

A Dataset to Support Research in the Design of Secure Water Treatment Systems (2016, methodology): “Such datasets include, for example, the DARPA Intrusion Detection Evaluation Dataset [3] and the NSL-KDD99 [2] datasets.”
Learning nonstationary models of normal network traffic for detecting novel attacks (2002, methodology): “Attribute r/n shows the result of training PHAD with C = 32 on "inside" week 3 (7 days of attack free network traffic) from the DARPA IDS data set [9].”
Detecting Unknown Network Attacks Using Language Models (2006, methodology): “This well-known dataset from an IDS evaluation conducted by the DARPA in 1999 (35) has been used in numerous publications and can be considered a standard benchmark for evaluation of IDS.”
A Survey of Network-based Intrusion Detection Data Sets (2019, neutral): “authentication request, ARP flooding, injection, probe request) Booters [52] 9 different DDoS attacks Botnet [5] botnets (Menti, Murlo, Neris, NSIS, Rbot, Sogou, Strom, Virut, Zeus) CIC DoS [53] Application layer DoS attacks (executed through ddossim, Goldeneye, hulk, RUDY, Slowhttptest, Slowloris) ”
An overview of anomaly detection techniques: Existing solutions and latest technological trends (2007, background): “Mahoney et al. experimented with anomaly detection over the DARPA network data [44] by range matching network packet header fields.”
Outside the Closed World: On Using Machine Learning for Network Intrusion Detection (2010, background): “Intuitively, when achieving better results on the same data than anybody else, one would expect this to be a deﬁnite contribution to the progress of the ﬁeld.”
DeepDefense: Identifying DDoS Attack via Deep Learning (2017, background): “Other available public datasets are even older: KDD Cup 1999 [38], MIT Lincoln Laboratory DARPA 2000 [39], CAIDA DDoS Attack 2007 [40], and TUIDS DDoS dataset 2012 [41].”
Anomalous Payload-Based Worm Detection and Signature Generation (2005, methodology): “In our previous RAID paper [20], we showed PAYL’s accuracy for the DARPA99 dataset, which contains a lot of artifacts that make the data too regular [9].”
IP covert timing channels: design and detection (2004, methodology): “Our synthetic data set is the ’99 DARPA data set for Telnet and HTTP traffic [21].”
Timeseries Anomaly Detection using Temporal Hierarchical One-Class Network (2020, methodology): “…timeseries data sets are used: (i) 2D-gesture [9], which records the X-Y coordinate sequences of hand gestures in a video; (ii) Power demand [9], which contains a year of power demand at a Dutch research facility; (iii) KDD-Cup99 data from the DARPA’98 Intrusion Detection Evaluation Program [14].”
MAWILab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking (2010, background): “For example, the DARPA Intrusion Detection Evaluation Program [24] has been a great effort to provide labeled traffic to evaluate intrusion detection systems (IDS).”
Anomaly-based network intrusion detection: Techniques, systems and challenges (2009, methodology): “The DARPA project was reviewed in 1999, and the resulting 1999 DARPA/Lincoln Laboratory intrusion detection evaluation dataset (IDEVAL) became a widely used benchmarking tool by which synthetic network traffic was generated (Lippmann et al., 2000).”