Table 4.

Five main categories of KDD CUP 1999 dataset.

Attacks	Descriptions
Normal	Normal traffic
DoS	Denial of service, e.g., syn flood
R2L	Unauthorized access from a remote machine, e.g., guessing password
U2R	Unauthorized access to local superuser (root) privileges, e.g., various “buffer overflow” attacks
Probing	Surveillance and other probing, e.g., port scanning