Research Article
A Universal High-Performance Correlation Analysis Detection Model and Algorithm for Network Intrusion Detection System
Table 1
KDD1999 sample category distribution and partly attack type statistics.
| Data set | Attack type | The training set | The test set |
| NORMAL | / | 97278 | 60593 |
| DOS | apache2 | / | 794 | back | 2203 | 1098 | land | 21 | 9 | mailbomb | / | 5000 | neptune | 107201 | 58001 | pod | 264 | 87 | processtable | / | 759 |
| PROBE | ipsweep | 1247 | 306 | mscan | / | 1053 | nmap | 231 | 84 | portsweep | 1040 | 354 | saint | / | 736 | satan | 1589 | 1633 |
| R2L | ftp_write | 8 | 3 | imap | 12 | 1 | named | / | 17 | phf | 4 | 2 | sendmail | / | 17 |
| U2R | httptunnel | / | 158 | loadmodule | 9 | 2 | perl | 3 | 2 | ps | / | 16 | rootkit | 10 | 13 | sqlattack | / | 2 |
| Total | 39 | 494021 | 311029 |
|
|