![](bg5.png)
4.3 Related Work
Allen and Marin (Allen, 2003) examine the
attack-free training data for the presence of
self-similarity in various time periods by using
periodogram method and Whittle’s MLE. Their
finding results show that the 1999 DARPA
evaluation data exhibits self-similarity during from
08 AM to 06 PM periods, while our results show that
the evaluation data does during from 08 AM to 09
PM periods of week 1 on both inside and outside
network, and during from 08 AM to 07 PM periods
of week 3 on the inside network and from 08 AM to
10 PM periods on the outside network.
Compared with (Allen, 2003), we provide more
accurate and detailed Hurst parameter values by
using more estimation methods, and consider the
difference of the evaluation data on the inside
network from that on the outside network.
5 CONCLUSIONS
This paper examines the self-similarity of the 1999
DARPA/Lincoln Laboratory evaluation data by
using five estimation methods of Hurst parameter.
The experimental results denote that the evaluation
data clearly exhibits self-similarity during from 08
AM to 09 PM periods of week 1 on both inside and
outside network, and during from 08 AM to 07 PM
periods of week 3 on the inside network and during
from 08 AM to 10 AM periods on the outside
network, while during other time periods it fails
self-similarity.
Three likely causes failing self-similarity are
explored as follows: (1) traffic rate is too lower (2)
certain application-level protocol (i.e., HTTP)
generated by Poisson model absolutely dominates
the whole traffic;(3) UDP dominates the whole
traffic and dilutes the effect of TCP, which result in
showing little self-similarity. Our findings would
help evaluators to use the evaluation data well to
evaluate IDSs.
ACKNOWLEDGEMENTS
This work is supported by the National Natural
Science Foundation of China under Grant
No60473031.
REFERENCES
Denning, D.E., 1987.An intrusion-detection model. IEEE
Transactions on Software Engineering, Vol.13,
pp.222-232
Puketza, N., Zhang, K., Chung, M., et al, 1996. A
methodology for testing intrusion detection systems.
IEEE Transactions on Software Engineering, Vol.22,
pp. 719-729
Richard, P., Lippmann, R., Fried, D., et al, 2000.
Evaluating intrusion detection systems: the 1998
DARPA off-line intrusion detection evaluation. Proc.
of the 2000 DARPA Information Survivability
Conference and Exposition, Hilton Head, South
Carolina, pp.12-26
Lippmann, R., Haines, J., Fried, D., et al, 2000.The 1999
DARPA off-line intrusion detection evaluation.
Computer Networks, Vol.34, pp.579-595
Lippmann, R., Haines, J., Fried, D., et al, 2000.Analysis
and results of the 1999 DARPA off-line intrusion
detection evaluation, Proc. of Third International
Workshop on Recent Advances in Intrusion Detection,
Toulouse, France 162-182
McHung, J., 2001.Testing intrusion detection systems: a
critique of the 1998 and 1999 DARPA intrusion
detection system evaluations as performed by Lincoln
laboratory. ACM Transactions on Information and
System Security, Vol.3, ppt.262-294
Leland, W., Taqqu, M., Willinger, W., et al, 1994.On the
self-similar nature of Ethernet traffic. IEEE/ACM
Transactions on Networking, Vol.2, pp.1-15
Paxson, V., Floyd, S., 1995.Wide-area traffic: the failure
of Poisson modeling. IEEE/ACM Transactions on
Networking, Vol.3, pp.226-244
Beran, J., Sherman, R., Taqqu, M., et al, 1995 .Long-range
dependence in variable bit-rate video traffic. IEEE
Transaction on Communications, Vol.43, pp.556-1579
MIT Lincoln Laboratory, 2003.Intrusion detection
evaluation web site. http://www.ll.mit.edu/IST/ideval
Rose, O., 1996. Estimation of the hurst parameter of
long-range dependent time series. Technical Report
No.137, Institute of Computer Science, University of
Würzburg
Park, K., Kim, G., Crovella, M., 1996.On the relationship
between file sizes, transport protocols, and self-similar
network traffic. In: Proc. of 4th International
Conference on Network Protocol, pp.171-180
Allen, W. H., Marin, G. A., 2003.On the self-similarity of
synthetic traffic for the evaluation of intrusion
detection. Proc. of the 2003 Symposium Applications
and the Internet, pp.242-248
ON THE SELF-SIMILARITY OF THE 1999 DARPA/LINCOLN LABORATORY EVALUATION DATA
79