title: Classification - KDD-Cup 1999 and DARPA 1998/99 Public Intrusion Detection Datasets
body: <p>How are the very huge <a href="http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html" rel="nofollow">KDD-Cup 1999</a> and <a href="http://www.ll.mit.edu/ideval/data/" rel="nofollow">DARPA 1998/99</a> intrusion detection public datasets generated? Anyone who knows the software tool they have used to classify and keep the state of the sessions of these raw datasets?  I mean once you generated the network data, how do you classify sessions as <code>anomalous (intrusion)</code> and <code>normal</code>? Is there any special software tool or machine which does that?</p>