DARPA 2000 dataset

This study used DARPA 2000 dataset since it has been widely used by researchers in the field. The type of NIDSs used to replay the dataset is signature –based RealSecure Version 6.0 (Internet Security System, 2000). This data are downloaded from Ning (2002). It contains four separated files which represent two types of simulated scenarios (Scenario One and Scenario Two) of Distributed Denial of Services (DDoS) network attack on two different networks. Haines (2000) mentioned that attacks in Scenario Two were stealthier than Scenario One. They contain thousand of event logs or network packets that have been reported from the Demilitarized Zone (DMZ) and Inside Networks.本研究采用DARPA 2000数据集（DARPA 2000 dataset），因其已被该领域研究者广泛使用。用于复现该数据集的网络入侵检测系统（NIDSs，Network Intrusion Detection Systems）为基于特征的RealSecure 6.0版本（Internet Security System，2000）。本数据集取自Ning（2002）公开的资源，包含四个独立文件，分别对应两类模拟攻击场景——场景一与场景二——针对两个不同网络的分布式拒绝服务攻击（DDoS，Distributed Denial of Services）场景。Haines（2000）指出，场景二中的攻击相较于场景一更具隐蔽性。该数据集包含数千条来自非军事区（DMZ，Demilitarized Zone）与内部网络的事件日志或网络数据包。