KDD Cup 1999 Data
The author said Bro is modified to generate the 41 features, I
would preciated if someone is kind enough to give me some hints how
to do this. I am sure a event analyser and handler sould added to
Bro, but where, how and when to invoke the event handler.
Presumably, yes, they wrote policy scripts, and perhaps also extended
the event engine. But it seems you should ask the authors directly
to get the details.
Vern