A novel attack is a network attack whose form was absent from the attacks used to train a classifier. Because classifiers recognize only covered attack forms, recurring novel attacks make outlier detection necessary. section 5.2.1
Interpret novel attacks cautiously:
- Rare attacks may be easier to identify as outliers, but labeled outliers can be masked by other statistical outliers. section 5.2.1
- Anomaly detectors can gradually learn malicious behavior as normal when attackers introduce it benignly and make it common. section 5.2.1
Table 5.1 Sample of KDD Cup dataset (view table figure)
| duration |
protocol type |
service |
src bytes |
dst bytes |
logged in |
su attempted |
num file creations |
num access files |
serror rate |
|---|---|---|---|---|---|---|---|---|---|
| 0 |
tcp |
http |
234 |
5450 |
1 |
0 |
1 |
1 |
0.00 |
| 0 |
icmp |
http |
256 |
487 |
1 |
0 |
0 |
0 |
0.00 |
| 3 |
tcp |
private |
158 |
1535 |
0 |
0 |
0 |
0 |
0.07 |
| 5 |
udp |
smtp |
199 |
2363 |
1 |
0 |
0 |
0 |
0.00 |
| 0 |
icmp |
other |
310 |
2361 |
1 |
1 |
0 |
0 |
0.00 |
Inspect network-connection features such as duration, protocol type, service, byte counts, login status, file creations, and error rate. section 5.2.1
