These attack types include processtable, mscan, snmpguess, snmpgetattack, saint, apache2, httptunnel, back and mailbomb
. This means that trained models have never seen these attacks during training as they were not available in training data.
Normal and attack traffic information for KDD99 dataset DoS Probe Total Total Dataset instances Attacks instances Attacks 10% KDD 391458 apache2 4107 satan, smurf, ipsweep, Corrected 229853 neptune, 4107 portsweep, KDD back, nmap, mscan, teardrop, saint Whole KDD 229853 pod, land, 4107 mailbomb
, syn flood, ping of death, syslogd, process table udpstorm u2r Total Dataset instances Attacks 10% KDD 52 buffer overflow, Corrected 52 rootkit, KDD loadmodule, perl, ps, Whole KDD 52 xterm, eject, ffbconfig, fdformat r2l Total Dataset instances Attacks Normal 10% KDD 1126 warezclient, 97277 guess passwd, Corrected 1126 warezmaster, 97277 KDD imap, ftp write, Whole KDD 1126 multihop, 97277 phf, spy, named, sendmail, xlock, xsnoop Table VIII.