5) **Probing (Probe) is an attack that scans a network to gather information or find known** vulnerabilities. An intruder with a map of machines and services that are available on a network can use the information to look for exploits. 

In KDD99 dataset these four attacks (DoS, U2R, R2L, and probe) are divided into 22 different attacks that tabulated in Table 2. 

| 4 Main Attack Classes   | 22 Attacks Classes                                                           |
|-------------------------|------------------------------------------------------------------------------|
| Denial of Service (DoS) | back, land, neptune, pod, smurt, teardrop                                    |
| Remote to User (R2L)    | ftp_write, guess_passwd, imap, multihop, phf, spy,  warezclient, warezmaster |
| User to Root (U2R)      | buffer_overflow, perl, loadmodule, rootkit                                   |
| Probing                 | ipsweep, nmap, portsweep, satan                                              |

Table 2. Different Types of attacks in KDD99 Dataset.

There are total 41 input attributes in KDD99 dataset for each network connection that have either discrete or continuous values and divided into three groups. The first group of attributes is the basic features of network connection, which include the duration, prototype, service, number of bytes from source IP addresses or from destination IP addresses, and some flags in TCP connections. The second group of attributes in KDD99 is composed of the content features of network connections and the third group is composed of the statistical features that are computed either by a time window or a window of certain kind of connections. The list of the input attributes in KDD99 dataset for each network connections is shown in the Table 3. 

| No   | Input Attribute    | Type   | No   | Input Attribute             | Type   |
|------|--------------------|--------|------|-----------------------------|--------|
| 1    | Duration           | Con.   | 22   | is_guest_login              | Dis.   |
| 2    | protocol_type      | Dis.   | 23   | Count                       | Con.   |
| 3    | Service            | Dis.   | 24   | srv_count                   | Con.   |
| 4    | Flag               | Dis.   | 25   | serror_rate                 | Con.   |
| 5    | src_bytes          | Con.   | 26   | srv_serror_rate             | Con.   |
| 6    | dst_bytes          | Con.   | 27   | rerror_rate                 | Con.   |
| 7    | Land               | Dis.   | 28   | srv_rerror_rate             | Con.   |
| 8    | wrong_fragment     | Con.   | 29   | same_srv_rate               | Con.   |
| 9    | Urgent             | Con.   | 30   | diff_srv_rate               | Con.   |
| 10   | Hot                | Con.   | 31   | srv_diff_host_rate          | Con.   |
| 11   | num_failed_logins  | Con.   | 32   | dst_host_count              | Con.   |
| 12   | logged_in          | Dis.   | 33   | dst_host_srv_count          | Con.   |
| 13   | num_compromised    | Con.   | 34   | dst_host_same_srv_rate      | Con.   |
| 14   | root_shell         | Con.   | 35   | dst_host_diff_srv_rate      | Con.   |
| 15   | su_attempted       | Con.   | 36   | dst_host_same_src_port_rate | Con.   |
| 16   | num_root           | Con.   | 37   | dst_host_srv_diff_host_rate | Con.   |
| 17   | num_file_creations | Con.   | 38   | dst_host_serror_rate        | Con.   |
| 18   | num_shells         | Con.   | 39   | dst_host_srv_serror_rate    | Con.   |
| 19   | num_access_files   | Con.   | 40   | dst_host_rerror_rate        | Con.   |
| 20   | num_outbound_cmds  | Con.   | 41   | dst_host_srv_rerror_rate    | Con.   |
| 21   | is_host_login      | Dis.   | -    | -                           | -      |

Table 3. Input attributes in KDD99 Dataset. 