All Apps and Add-ons

Seeking Assistance: Replicating "Predict the Presence of Malware" Model in Splunk's MLTK?

New Member


I am a student conducting research related to the MLTK app of Splunk. One of the topics of my work is to explore and attempt to apply the same model as the "Predict the Presence of Malware" - one of the sample examples in MLTK. I would like to learn more about how the data for this model was collected, such as the firewall used, the operating system, and other relevant details, so that I can reproduce it on my own machine and collect the data as well. As I am new to the security field, any additional information would be greatly appreciated.

Additionally, I have been able to retrieve some of the fields used in the model, such as src_ip, src_port, session_id, serial_number, receive_time, packets_sent, has_known_vulnerability, dst_ip, dest_port, bytes_sent, and bytes_received. However, I am unsure about how to obtain the packets_received field. Any guidance or assistance on retrieving this particular field would be highly valuable.

Thank you.


Labels (1)
0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...