SMTP traffic simulation for intrusion detection dataset evaluation

The dataset evaluation methodology is a feasible and effective way to evaluate the performance of intrusion detection systems.The dataset contains background traffic and attack traffic.Thedesign and simulation ofbackground traffic is critical to the datasetbecause the characters of real network are presented.A method based on SMTP and POP3 log clustering is presented to model the SMTP traffic.The high performance and scalability of synthetic traffic make it more flexible and feature the advantage for IDS evaluation.