A Universal High-Performance Correlation Analysis Detection Model and Algorithm for Network Intrusion Detection System

Table 1

KDD1999 sample category distribution and partly attack type statistics.

Data set	Attack type	The training set	The test set
NORMAL	/	97278	60593
DOS	apache2	/	794
	back	2203	1098
	land	21	9
	mailbomb	/	5000
	neptune	107201	58001
	pod	264	87
	processtable	/	759
PROBE	ipsweep	1247	306
	mscan	/	1053
	nmap	231	84
	portsweep	1040	354
	saint	/	736
	satan	1589	1633
R2L	ftp_write	8	3
	imap	12	1
	named	/	17
	phf	4	2
	sendmail	/	17
U2R	httptunnel	/	158
	loadmodule	9	2
	perl	3	2
	ps	/	16
	rootkit	10	13
	sqlattack	/	2
Total	39	494021	311029