All Apps and Add-ons

Seeking Assistance: Replicating "Predict the Presence of Malware" Model in Splunk's MLTK?

LuisFelipe
New Member

Hello,

I am a student conducting research related to the MLTK app of Splunk. One of the topics of my work is to explore and attempt to apply the same model as the "Predict the Presence of Malware" - one of the sample examples in MLTK. I would like to learn more about how the data for this model was collected, such as the firewall used, the operating system, and other relevant details, so that I can reproduce it on my own machine and collect the data as well. As I am new to the security field, any additional information would be greatly appreciated.

Additionally, I have been able to retrieve some of the fields used in the model, such as src_ip, src_port, session_id, serial_number, receive_time, packets_sent, has_known_vulnerability, dst_ip, dest_port, bytes_sent, and bytes_received. However, I am unsure about how to obtain the packets_received field. Any guidance or assistance on retrieving this particular field would be highly valuable.

Thank you.

 

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...