<<34 continuous's + 7 symbolic = 41 attributes>> 01) duration: continuous. => pca-03 02) protocol_type: symbolic. => pca-10 03) service: symbolic. => pca-08 04) flag: symbolic. => pca-09 05) src_bytes: continuous. => pca-01 06) dst_bytes: continuous. => pca-02 07) land: symbolic. 08) wrong_fragment: continuous. 09) urgent: continuous. 10) hot: continuous. => pca-12 11) num_failed_logins: continuous. 12) logged_in: symbolic. 13) num_compromised: continuous. => pca-13 14) root_shell: continuous. 15) su_attempted: continuous. 16) num_root: continuous. => pca-11 17) num_file_creations: continuous. 18) num_shells: continuous. 19) num_access_files: continuous. 20) num_outbound_cmds: continuous. 21) is_host_login: symbolic. => pca-05 22) is_guest_login: symbolic. => pca-04 23) count: continuous. => pca-19 24) srv_count: continuous. => pca-17 25) serror_rate: continuous. 26) srv_serror_rate: continuous. 27) rerror_rate: continuous. => pca-16 28) srv_rerror_rate: continuous. 29) same_srv_rate: continuous. 30) diff_srv_rate: continuous. => pca-07 31) srv_diff_host_rate: continuous. => pca-06 32) dst_host_count: continuous. => pca-15 33) dst_host_srv_count: continuous. 34) dst_host_same_srv_rate: continuous. => pca-14 35) dst_host_diff_srv_rate: continuous. 36) dst_host_same_src_port_rate: continuous. 37) dst_host_srv_diff_host_rate: continuous. => pca-18 38) dst_host_serror_rate: continuous. 39) dst_host_srv_serror_rate: continuous. 40) dst_host_rerror_rate: continuous. 41) dst_host_srv_rerror_rate: continuous. <> 22 types perl u2r => 212 phf r2l => 213 spy r2l => 219 teardrop dos => 220 warezclient r2l => 221 --- guess_passwd r2l => 204 -> warezmaster r2l => 222 snmpgetattack. => 300 nmap probe => 211 loadmodule u2r => 208 imap r2l => 205 back dos => 201 buffer_overflow u2r => 202 udpstrom => 400 ipsweep probe => 206 neptune dos => 210 smurf dos => 218 rootkit u2r => 216 ps => 401 sendmail 402 portsweep probe => 215 -> multihop r2l => 209 -> httptunnel. 403 worm 404 teardrop 405 saint 301 -> land dos => 207 sqlattack. 406 apache2. 407 satan probe => 217 pod dos => 214 -> ftp_write r2l => 203 named 500 mscan 302 mailbomb 303 snmpguess 304 normal => 100