ADFA-IDS

ADFA-WD (Windows dataset) was generated on a Windows XP Service Pack 2 host OS with the XP default firewall enabled for all attacks, and file sharing enabled, a network printer configured, wireless and Ethernet networking. Norton AV 2013 was used to scan certain payloads. FTP server, web server and management tool, and streaming audio digital radio package were activated. A target ratio of 1 : 10 : 1 =normal data:validation data:attack data was used to guide collection and structuring activities. Vectors: TCP ports, web based vectors, browser attacks, and malware attachments Effects: Bind shell, reverse shell, exploitation payload, remote operation, staging, system manipulation, privilege escalation, data exfiltration, and back-door insertion.

ADFA-WD（Windows数据集）生成于搭载Windows XP Service Pack 2的主机操作系统，该实验环境针对各类攻击场景启用了Windows XP默认防火墙，开启了文件共享功能，配置了网络打印机，并部署了无线与以太网网络。本次实验采用诺顿杀毒软件2013（Norton AV 2013）对部分攻击有效载荷（payload）进行扫描，同时启用了FTP服务器、Web服务器与管理工具，以及流式音频数字广播套件。数据集的采集与结构化工作遵循1:10:1的目标配比，即正常数据：验证数据：攻击数据。本次实验覆盖的攻击向量包括TCP端口、基于Web的攻击向量、浏览器攻击与恶意软件附件，可复现以下攻击效果：绑定Shell、反向Shell、利用型有效载荷、远程操作、暂存部署、系统操控、权限提升、数据外泄与后门植入。