# sklearn.datasets.fetch_kddcup99¶

sklearn.datasets.fetch_kddcup99(subset=None, data_home=None, shuffle=False, random_state=None, percent10=True, download_if_missing=True, return_X_y=False)[source]

Load and return the kddcup 99 dataset (classification).

The KDD Cup ‘99 dataset was created by processing the tcpdump portions of the 1998 DARPA Intrusion Detection System (IDS) Evaluation dataset, created by MIT Lincoln Lab [1]. The artificial data was generated using a closed network and hand-injected attacks to produce a large number of different types of attack with normal activity in the background. As the initial goal was to produce a large training set for supervised learning algorithms, there is a large proportion (80.1%) of abnormal data which is unrealistic in real world, and inappropriate for unsupervised anomaly detection which aims at detecting ‘abnormal’ data, ie

1. qualitatively different from normal data.
2. in large minority among the observations.

We thus transform the KDD Data set into two different data sets: SA and SF.

• SA is obtained by simply selecting all the normal data, and a small proportion of abnormal data to gives an anomaly proportion of 1%.
• SF is obtained as in [2] by simply picking up the data whose attribute logged_in is positive, thus focusing on the intrusion attack, which gives a proportion of 0.3% of attack.
• http and smtp are two subsets of SF corresponding with third feature equal to ‘http’ (resp. to ‘smtp’)

General KDD structure :

 Samples total 4898431 Dimensionality 41 Features discrete (int) or continuous (float) Targets str, ‘normal.’ or name of the anomaly type

SA structure :

 Samples total 976158 Dimensionality 41 Features discrete (int) or continuous (float) Targets str, ‘normal.’ or name of the anomaly type

SF structure :

 Samples total 699691 Dimensionality 4 Features discrete (int) or continuous (float) Targets str, ‘normal.’ or name of the anomaly type

http structure :

 Samples total 619052 Dimensionality 3 Features discrete (int) or continuous (float) Targets str, ‘normal.’ or name of the anomaly type

smtp structure :

 Samples total 95373 Dimensionality 3 Features discrete (int) or continuous (float) Targets str, ‘normal.’ or name of the anomaly type

New in version 0.18.

Parameters: subset : None, ‘SA’, ‘SF’, ‘http’, ‘smtp’ To return the corresponding classical subsets of kddcup 99. If None, return the entire kddcup 99 dataset. data_home : string, optional Specify another download and cache folder for the datasets. By default all scikit-learn data is stored in ‘~/scikit_learn_data’ subfolders. .. versionadded:: 0.19 shuffle : bool, default=False Whether to shuffle dataset. random_state : int, RandomState instance or None (default) Determines random number generation for dataset shuffling and for selection of abnormal samples if subset=’SA’. Pass an int for reproducible output across multiple function calls. See Glossary. percent10 : bool, default=True Whether to load only 10 percent of the data. download_if_missing : bool, default=True If False, raise a IOError if the data is not locally available instead of trying to download the data from the source site. return_X_y : boolean, default=False. If True, returns (data, target) instead of a Bunch object. See below for more information about the data and target object. New in version 0.20. data : Bunch Dictionary-like object, the interesting attributes are: ‘data’, the data to learn and ‘target’, the regression target for each sample. (data, target) : tuple if return_X_y is True New in version 0.20.

References

 [1] Analysis and Results of the 1999 DARPA Off-Line Intrusion Detection Evaluation Richard Lippmann, Joshua W. Haines, David J. Fried, Jonathan Korba, Kumar Das
 [2] K. Yamanishi, J.-I. Takeuchi, G. Williams, and P. Milne. Online unsupervised outlier detection using finite mixtures with discounting learning algorithms. In Proceedings of the sixth ACM SIGKDD international conference on Knowledge discovery and data mining, pages 320-324. ACM Press, 2000.