用于入侵检测数据集评测的SMTP流量模拟

SMTP traffic simulation for intrusion detection dataset evaluation

利用评测数据集对入侵检测系统进行评测是目前可行并且有效的评估手段,数据集包括背景流量和攻击流量两部分。背景流量的设计和模拟非常重要,因为背景流量体现实际网络的特征。提出了一种基于SMTP和POP3日志聚类的建模方法用于入侵检测评测数据集中SMTP流量的模拟,保留了网络和用户的特征,具有较好的扩展性,可以根据评测需要灵活定制SMTP流量。

The dataset evaluation methodology is a feasible and effective way to evaluate the performance of intrusion detection systems. The dataset contains background traffic and attack traffic. The design and simulation ofbackground traffic is critical to the dataset because the characters of real network are presented. A method based on SMTP and POP3 log clustering is presented to model the SMTP traffic. The high performance and scalability of synthetic traffic make it more flexible and feature the advantage for IDS evaluation.