DARPA2000数据集

header,215,2,setaudit(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 651883940 msec,argument,1,0x0,setaudit:auid,argument,1,0x600001,setaudit:port,argument,1,0xca4da2d5,setaudit:machine,argument,1,0xffffffff,setaudit:as_success,argument,1,0xffffffff,setaudit:as_failure,argument,1,0x28f,setaudit:asid,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,215 header,130,2,open(2) - read,,Sun 16 Apr 2000 03:41:48 PM EDT, + 651883940 msec,path,/etc/security/audit_control,attribute,100640,root,sys,8388608,22818,0,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,success,4,trailer,130 header,154,2,ioctl(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 651883940 msec,path,/etc/security/audit_control,attribute,100640,root,sys,8388608,22818,0,argument,2,0x5401,cmd,argument,3,0xffbef444,arg,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,failure: Inappropriate ioctl for device,-1,trailer,154 header,141,2,close(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 651883940 msec,argument,1,0x4,fd,path,/etc/security/audit_control,attribute,100640,root,sys,8388608,22818,0,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,141 header,127,2,open(2) - read,,Sun 16 Apr 2000 03:41:48 PM EDT, + 651883940 msec,path,/etc/security/audit_user,attribute,100640,root,sys,8388608,22820,0,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,success,4,trailer,127 header,151,2,ioctl(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 651883940 msec,path,/etc/security/audit_user,attribute,100640,root,sys,8388608,22820,0,argument,2,0x5401,cmd,argument,3,0xffbef44c,arg,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,failure: Inappropriate ioctl for device,-1,trailer,151 header,138,2,close(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 651883940 msec,argument,1,0x4,fd,path,/etc/security/audit_user,attribute,100640,root,sys,8388608,22820,0,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,138 header,128,2,open(2) - read,,Sun 16 Apr 2000 03:41:48 PM EDT, + 651883940 msec,path,/etc/security/audit_event,attribute,100644,root,sys,8388608,22819,0,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,success,4,trailer,128 header,152,2,ioctl(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 651883940 msec,path,/etc/security/audit_event,attribute,100644,root,sys,8388608,22819,0,argument,2,0x5401,cmd,argument,3,0xffbef64c,arg,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,failure: Inappropriate ioctl for device,-1,trailer,152 header,139,2,close(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 651883940 msec,argument,1,0x4,fd,path,/etc/security/audit_event,attribute,100644,root,sys,8388608,22819,0,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,139 header,128,2,open(2) - read,,Sun 16 Apr 2000 03:41:48 PM EDT, + 651883940 msec,path,/etc/security/audit_event,attribute,100644,root,sys,8388608,22819,0,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,success,4,trailer,128 header,152,2,ioctl(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 651883940 msec,path,/etc/security/audit_event,attribute,100644,root,sys,8388608,22819,0,argument,2,0x5401,cmd,argument,3,0xffbef64c,arg,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,failure: Inappropriate ioctl for device,-1,trailer,152 header,139,2,close(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 661882186 msec,argument,1,0x4,fd,path,/etc/security/audit_event,attribute,100644,root,sys,8388608,22819,0,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,139 header,88,2,login - telnet,,Sun 16 Apr 2000 03:41:48 PM EDT, + 661882186 msec,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,text,successful login,return,success,0,trailer,88 header,86,2,fork(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 661882186 msec,argument,0,0x290,child PID,subject,root,root,root,root,root,655,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,86 header,80,2,old setgid(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 661882186 msec,argument,1,0x0,gid,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,80 header,113,2,open(2) - read,,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,path,/etc/group,attribute,100644,root,sys,8388608,34301,0,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,4,trailer,113 header,137,2,ioctl(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,path,/etc/group,attribute,100644,root,sys,8388608,34301,0,argument,2,0x5401,cmd,argument,3,0xffbef934,arg,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,failure: Inappropriate ioctl for device,-1,trailer,137 header,124,2,close(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,argument,1,0x4,fd,path,/etc/group,attribute,100644,root,sys,8388608,34301,0,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,124 header,86,2,setgroups(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,argument,1,0x0,setgroups,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,86 header,134,2,stat(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,path,/usr/lib/security/pam_unix.so.1,attribute,100755,root,sys,8388614,45598,0,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,134 header,80,2,old setuid(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,argument,1,0x0,uid,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,80 header,107,2,chdir(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,path,/tmp,attribute,41777,sys,sys,1,234893721,0,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,107 header,93,2,munmap(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,argument,1,0xff0e4000,addr,argument,2,0x4878,len,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,93 header,93,2,munmap(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,argument,1,0xff0c0000,addr,argument,2,0x14ac6,len,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,93 header,162,2,open(2) - write,,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,path,/devices/pseudo/log@0:conslog,attribute,20666,root,sys,8388608,34318,5505024,argument,3,0x2,stropen: flag,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,4,trailer,162 header,137,2,open(2) - read,,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,path,/usr/share/lib/zoneinfo/US/Eastern,attribute,100644,bin,bin,8388614,233564,0,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,5,trailer,137 header,148,2,close(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,argument,1,0x5,fd,path,/usr/share/lib/zoneinfo/US/Eastern,attribute,100644,bin,bin,8388614,233564,0,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,148 header,91,2,putmsg(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,argument,1,0x4,fd,argument,4,0x0,pri,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,91 header,120,2,open(2) - read,,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,path,/etc/.syslog_door,attribute,150644,root,root,46923776,387,46661632,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,5,trailer,120 header,121,2,doorfs(2) - DOOR_CALL,,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,argument,1,0x5,door ID,process,-2,root,root,root,root,192,0,0,0.0.0.0,subject,root,root,root,root,root,656,655,24 1 ppp5-213.iawhk.com,return,success,0,trailer,121 header,131,2,close(2),,Sun 16 Apr 2000 03:41:48 PM EDT, + 671881018 msec,argument,1,0x5,fd,path,/etc/.syslog_door,attribute,150644,root,root,46923776,387,46661632,subject,root,roo