如何将 KDD 99 数据集转换为 tcpdump 格式？

Question

谁能指导我将KDD 99 数据集（由以下格式的ip 数据包组成）转换为TCP 转储格式？

0,udp,private,SF,105,146,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,0.00,0.00,0.00,0.00,1.00,0.00,0.00,255,254,1.00,0.01,0.00,0.00,0.00,0.00,0.00,0.00,normal.
0,udp,private,SF,105,146,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,0.00,0.00,0.00,0.00,1.00,0.00,0.00,255,254,1.00,0.01,0.00,0.00,0.00,0.00,0.00,0.00,normal.
0,udp,private,SF,105,146,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,0.00,0.00,0.00,0.00,1.00,0.00,0.00,255,254,1.00,0.01,0.00,0.00,0.00,0.00,0.00,0.00,normal.

Answer 1

来自KDD99 homepage：

1998 年 DARPA 入侵检测 制定了评估计划并 由麻省理工学院林肯实验室管理。 ... 这 1999年KDD入侵检测大赛 使用此数据集的一个版本。

对原始 DARPA 数据集和 PCAP 网络捕获文件中包含的信息有些熟悉，我可以告诉您，KDD99 数据文件包含的信息远不足以重建适当的网络捕获文件。

KDD99 似乎是 DARPA IDEVAL98 数据集的简化版本，其中只保留高级操作，例如连接，而不是单个数据包。如果您需要实际的网络捕获文件，您可能应该获取原始的DARPA IDEVAL data sets。