An Analysis of the 1999 DARPA/Lincoln Laboratory Evaluation Data for Network Anomaly Detection

By Matthew V. Mahoney, Philip Ka-Fai Chan. 2003

635 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

The security of machine learning (2010, background): “In their study of the DARPA/Lincoln Laboratory IDS evaluation dataset, Mahoney and Chan (2003) demonstrate that spurious artifacts in training data can cause an IDS to learn to distinguish normal from intrusion traffic based on those artifacts rather than relevant features.”
Motivating the Rules of the Game for Adversarial Example Research (2018, background): “…security has a long history and our critique does not apply to some existing work, for example, on spam detection [73] (this uses an l 0 -constrained attack model but provides a realistic justiﬁcation for it), malware detection [74], and securing network intrusion detection systems [75, 76].”
Outside the Closed World: On Using Machine Learning for Network Intrusion Detection (2010, background): “The point we wish to convey however is that we are working in an area where insight matters much more than just numerical results.”
Anomalous Payload-Based Network Intrusion Detection (2004, background): “Some of the systems reconstruct the network packets and extract features that describe the higher level interactions between end hosts like MADAMID [9], Bro [15], EMERALD [18], STAT [24], ALAD [13], etc.”
NETWORK INTRUSION DETECTION USING NAÏVE BAYES (2007, methodology): “Under the sponsorships of Defence Advanced Research projects Agency (DARPA) and Air force Research Laboratory (AFRL), MIT Lincoln Laboratory has collected and distributed the datasets for the evaluation of computer network intrusion detection systems [16, 17].”
Random-Forests-Based Network Intrusion Detection Systems (2008, background): “Some intrusions such as denial of service (DoS) [23] have much more connections than others (e.”
McPAD: A multiple classifier system for accurate payload-based anomaly detection (2009, background): “NETAD [23] monitors the ﬁrst 48 bytes of IP packets.”
Deep Learning Approach for Intelligent Intrusion Detection System (2019, result): “In contrast to critiques of strategy to create dataset, [50] revealed the detailed analysis of the contents and located the non-uniformity and simulated artifacts in the simulated network trafﬁc data.”
Network Intrusion Detection for IoT Security Based on Learning Techniques (2019, background): “Some of the important ones are [73], [77], [86]: – The probability distribution of the testing and training sets are different.”
Generation of a new IDS test dataset: Time to retire the KDD collection (2013, methodology): “Experiments continue to be conducted on the KDD data largely because of expedience [16], [18], [19], [20], [21].”
A Semantic Approach to Host-Based Intrusion Detection Systems Using Contiguousand Discontiguous System Call Patterns (2014, background): “Whilst increasingly criticised by articles such as [6], [7], [8], [9], [10], [11], the KDD98 is still used as a common benchmark for performance, though with a warranted level of scepticism about its applicability to the modern environment.”
A survey of intrusion detection in Internet of Things (2017, background): “Scientific advances rely on reproducibility of results so that they can be independently validated and compared by repeated large-sample tests (Mahoney and Chan, 2003).”
Data preprocessing for anomaly based network intrusion detection: A review (2011, background): “While it has known limitations (McHugh, 2000; Mahoney and Chan, 2003), its advantages include being publicly available, labeled, and preprocessed ready for machine learning.”
Anomaly Based Network Intrusion Detection with Unsupervised Outlier Detection (2006, methodology): “Under the sponsorship of Defense Advanced Research Projects Agency (DARPA) and Air Force Research Laboratory (AFRL), MIT Lincoln Laboratory has collected and distributed the datasets for the evaluation of computer network intrusion detection systems [20, 21].”
Language models for detection of unknown attacks in network traffic (2007, background): “Even though the DARPA 1999 dataset is known to su er from several aws and artifacts [10; 48; 49], especially the selection of attacks can be considered antiquated in comparison to modern security threats, it remains the only major dataset on which results can be reproduced.”
The use of computational intelligence in intrusion detection systems: A review (2010, background): “Malhony and Chan [207] confirmed McHugh’s findings by their experiments, which discovered that many attributes had small and fixed ranges in simulation, but large and growing ranges in real traffic.”