1999 KDD Cup 网络流量异常检测大赛特征

本文链接：https://blog.youkuaiyun.com/tortelee/article/details/81282331

本文详细介绍了网络入侵检测系统中使用的41个关键特征参数及其意义。这些参数涵盖了持续时间、协议类型、服务类型等重要方面，对于理解网络攻击模式至关重要。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

back,buffer_overflow,ftp_write,guess_passwd,imap,ipsweep,land,loadmodule,multihop,neptune,nmap,normal,perl,phf,pod,portsweep,rootkit,satan,smurf,spy,teardrop,warezclient,warezmaster.
1，duration: continuous.                         持续时间
2，protocol_type: symbolic.                      协议类型
3，service: symbolic.                            
4，flag: symbolic.
5，src_bytes: continuous.
6，dst_bytes: continuous.
7，land: symbolic.
8，wrong_fragment: continuous.
9，urgent: continuous.
10，hot: continuous.
11，num_failed_logins: continuous.
12，logged_in: symbolic.
13，num_compromised: continuous.
14，root_shell: continuous.
15，su_attempted: continuous.
16，num_root: continuous.
17，num_file_creations: continuous.
18，num_shells: continuous.
19，num_access_files: continuous.
20，num_outbound_cmds: continuous.
21，is_host_login: symbolic.
22，is_guest_login: symbolic.
23，count: continuous.
24，srv_count: continuous.
25，serror_rate: continuous.
26，srv_serror_rate: continuous.
27，rerror_rate: continuous.
28，srv_rerror_rate: continuous.
29，same_srv_rate: continuous.
30，diff_srv_rate: continuous.
31，srv_diff_host_rate: continuous.
32，dst_host_count: continuous.
33，dst_host_srv_count: continuous.
34，dst_host_same_srv_rate: continuous.
35，dst_host_diff_srv_rate: continuous.
36，dst_host_same_src_port_rate: continuous.
37，dst_host_srv_diff_host_rate: continuous.
38，dst_host_serror_rate: continuous.
39，dst_host_srv_serror_rate: continuous.
40，dst_host_rerror_rate: continuous.
41，dst_host_srv_rerror_rate: continuous.