如何將KDD 99數據集轉換爲tcpdump格式？

Question

任何人都可以指導我在轉換KDD 99數據集，包括ip數據包在以下格式到TCP轉儲格式？

0,udp,private,SF,105,146,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,0.00,0.00,0.00,0.00,1.00,0.00,0.00,255,254,1.00,0.01,0.00,0.00,0.00,0.00,0.00,0.00,normal. 
0,udp,private,SF,105,146,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,0.00,0.00,0.00,0.00,1.00,0.00,0.00,255,254,1.00,0.01,0.00,0.00,0.00,0.00,0.00,0.00,normal. 
0,udp,private,SF,105,146,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,0.00,0.00,0.00,0.00,1.00,0.00,0.00,255,254,1.00,0.01,0.00,0.00,0.00,0.00,0.00,0.00,normal. 

Answer 1

從KDD99 homepage：

1998年DARPA入侵檢測 評估計劃準備和 由麻省理工學院林肯實驗室管理。 ... 1999 KDD入侵檢測競賽 使用此數據集的一個版本。

來有些熟悉與原來的DARPA數據集，並與包含在PCAP網絡捕獲文件中的信息，我可以告訴你的是，KDD99數據文件包含遠不足夠的信息來重建一個合適的網絡捕獲文件。

似乎KDD99是DARPA IDEVAL98數據集的簡化版本，其中只保留了高級操作（如連接），而不是單個數據包。如果您需要實際的網絡捕獲文件，您應該可以獲得原始的DARPA IDEVAL data sets。