Hello,
I am a student conducting research related to the MLTK app of Splunk. One of the topics of my work is to explore and attempt to apply the same model as the "Predict the Presence of Malware" - one of the sample examples in MLTK. I would like to learn more about how the data for this model was collected, such as the firewall used, the operating system, and other relevant details, so that I can reproduce it on my own machine and collect the data as well. As I am new to the security field, any additional information would be greatly appreciated.
Additionally, I have been able to retrieve some of the fields used in the model, such as src_ip, src_port, session_id, serial_number, receive_time, packets_sent, has_known_vulnerability, dst_ip, dest_port, bytes_sent, and bytes_received. However, I am unsure about how to obtain the packets_received field. Any guidance or assistance on retrieving this particular field would be highly valuable.
Thank you.
