4 ms·
Very interesting. We were curious about the data prep for CUP99. Since one might actually expect "normal" traffic to be more heterogeneous than attack traffic (
by ericpauley 5y ago
Very interesting. We were curious about the data prep for CUP99. Since one might actually expect "normal" traffic to be more heterogeneous than attack traffic (which must actually implement an attack), switching the classes like this might actually overreport accuracy. Further, one could imagine a network where the majority of traffic is "anomalous", such as a DDoS where only the time-series data would be sufficient to detect the anomaly. Since CUP99 does not contain time-series data could you explain how you would learn concept drift on this dataset?
- siddharthb_ 5y agoThanks! Great questions. Existing papers switched the class for KDDCUP99 so we followed them to have a fair comparison. We also use UNSW and DoS which are time-series based datasets. Once the encoder is trained on few normal samples and use that to initialise the memory, MemStream will be able to handle anomalous samples even if they are in majority. Retraining can also be done at a later point if required.