How deeply does Outlier Detection in Python cover network attack?

Defines attack records through labeled examples and features, but does not explain individual attack mechanics.

Network attack

As explained in Outlier Detection in Python

A network attack is a malicious action or traffic pattern intended to compromise, disrupt, or misuse a computer network or its services.

A network attack is a nonnormal pattern of network use treated as an outlier or binary-classification target. Connection records may describe protocol, service, byte counts, login activity, file operations, and error rates. section 5.2.1

Common attack forms represented in the data include:

Smurf attacks section 5.2.1
Port sweeps section 5.2.1
Buffer overflows section 5.2.1

KDD Cup connection records

The KDD Cup dataset labels each row as normal or an attack type. Its extreme imbalance—about 99.7% normal rows—supports evaluating detectors against rare attacks, while warning that detector performance depends on the data type. section 5.2.1

Table 5.1 Sample of KDD Cup dataset (view table figure)

duration	protocol type	service	src bytes	dst bytes	logged in	su attempted	num file creations	num access files	serror rate
0	tcp	http	234	5450	1	0	1	1	0.00
0	icmp	http	256	487	1	0	0	0	0.00
3	tcp	private	158	1535	0	0	0	0	0.07
5	udp	smtp	199	2363	1	0	0	0	0.00
0	icmp	other	310	2361	1	1	0	0	0.00

Inspect sample connection records containing duration, protocol, service, byte counts, login status, file operations, and SYN-error rate. section 5.2.1

How Outlier Detection in Python covers it

liveBook manning.com

Read Outlier Detection in Python on liveBook Get the book at manning.com

Related concepts

man-in-the-middle attackincludes · A man-in-the-middle attack is a network attack in which an adversary intercepts, relays, impersonates, or alters communication between parties.
spoofing attackincludes · A spoofing attack is a deceptive attack in which an adversary impersonates a legitimate identity, device, sender, signal, service, or other trusted entity.
denial-of-service attackincludes · A denial-of-service attack is an attempt to make a system or service unavailable or degrade its ability to serve legitimate users by exhausting or disrupting its resources.

This explainer was generated by Manning's knowledge graph from the text of Outlier Detection in Python. The section links point to the parts of the book it draws on.