[Bro] Test Set question

[Sames, David]

Does anyone know what the ratio of "attack traffic" to "normal traffic"
is in a "representative" network? It's a pretty open-ended question, but
I need to construct a (decent) data set for an internal evaluation I'm
doing. I'd like to make sure (to the extent possible) that the attack
data isn't unfairly represented in the set.

 

Thanks!

 

Dave Sames

-----------------------------

SPARTA, Inc

7075 Samuel Morse Dr.

Columbia, MD 21046

(P) 410.872.1515 x317

(F) 410.872.8079

-----------------------------

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20050711/2dccba1f/attachment.html