[en] The database gureKDDCup has been generated within the UADI project (Unsupervised Anomaly Detection for Intrusion detection system) in which a classifier that detects intrusions or attacks in network based systems was developed. To develop this classifier we are going to use unsupervised classification techniques. The main distinctive feature of this project is that it uses the payload (body part of network packages) to detect attacks in network connections. The analysis of the payload to classify the connections is not a deeply analysed field, however, it seems that it is essential to detect attacks such as R2L (Remote to Local, its goal is to use resources without permission) and U2R (User to Root, its goal is to get root or administrative privileges without having them). In the classification process we have to handle with a huge amount of connections and discover useful patterns among them. Therefore, this leads us to the Data Mining field. Moreover, we want our UADI system to be able to discover patterns or generate the model of network traffic automatically, that is, we want the learning process to be automatic, and to do it possible, we are going to use Machine Learning techniques. But first it is essential to generate the apropriate database to work upon it. So the aim of this report is to explain the process we have followed to generate the database we used in the UADI project. The objective is to generate a database with similar characteristics to KDDCup99 which is broadly used database in the scientific environment, taking as starting point the Darpa98 (DARPA Intrusion Detection Data Sets). The generated database is called gureKDDCup and it has similar features to the ones in KDDCup99, but we added to it payload information and other features related to the connection such as IP address and port numbers. Next lines explains the steps followed to generate the KDDCup99 database because our aim is to repeat those steps as accurately as possible, to create KDDCup99 the database we need in UADI project, in other words, a new extension of the (KDDCup99+payload) that we called it gureKDDCup.

[eu] GureKDDCup datubasea UADI (Unsupervised Anomaly Detection for Intrusion detection system) proiektuaren barnean eraiki da. Proiektu honen helburu nagusia, sistema batean sarkinak (erasoak) detektatuko dituen sailkatzaile bat garatzea izango da, sailkatzaile hau garatzeko gainbegiratu gabeko sailkapeneko teknikak erabiliko direlarik. Proiektu honek duen berezitasunik nagusiena, konexioetan erasoak detektatzeko payload-a (paketeen datu eremua) erabiliko dela da. Konexioen sailkapena burutzeko payload-a erabiltzea oraindik sakon aztertu gabe dagoen arloa da baina badirudi R2L (Remote to Local, baliabide bat erabiltzeko eskubiderik izan gabe berau atzitzea du helburu) eta U2R (User to Root, erabiltzaile arrunt batek super-erabiltzaile edo administratzaile eskubideak lortzea du helburu) motako erasoak antzemateko ezinbestekoa dela.. Sailkapen prozesuan konexio kopuru izugarriarekin egin beharko dugu lan eta honek ezinbestean Data Mining munduan murgiltzea dakar. Sailkatzailea ikasteko prozesua automatikoa izatea nahiko dugu eta hortik Machine Learning (ikasketa automatikoa) arloak eskaintzen dizkigun teknikak erabiliko ditugu. Baina lehenik, beharrezkoa zaigu datubase egoki bat eraikitzea beraren gainean estrategia ezberdinak gainean ikertzeko. Beraz, txosten honen helburua, UADI proiektuak erabiliko duen datu-basea sortzeko jarraitutako prozesua azaltzea izango da. Datu-base hori lortzeko abiapuntua Darpa98 da eta helburua, ingurune zientifikoan erabiltzen den KDDCup datu-basearen antzeko ezaugarriak dituen beste bat sortzea da. Sortuko den datu-basearen (gurekddcup) ezaugarriak, KDDCup99 datu-basearenaren antzekoak izango dira, baina payload-ari dagokion informazioa eta konexioaren hainbat ezaugarri (IP helbideak, portu zenbakiak,...) gehiturik. Beraz jarraian, KDDCup99 sortzeko jarraitu ziren pausuak azalduko dira, ondoren gutxi gora behera antzeko pausuak jarraitu beharko baita gureKddcup, KDDCup99-ren hedapen berria sortzeko (kddcup99+payload), hau da, guk behar dugun datu-basea sortzeko.