[connect24h:9820] Re: 教えて、ExcelとAccessの偉い人

[hamamoto <hamamoto@xxxxxxxxxxxxxxxxx>]

はまもとです。

評判が良いみたいなので、お題を作ってみました。さぁ、この生データを
あなたならどう分析する？

Access、Excel、Ruby、Awk、Perl、Sed、MySQL、PHP、なんでも結構なので、
アイデアいただけると助かります。

以下、CSVファイルにしていただけたらと思います。

Time,Attack,Source IP,Source Port,Destination IP,Destination Port,Type,Application Protocol,Attack Count,Direction
08-13-05 17:27:25 ,UDP: Host Sweep,xx.ccc.158.ccc,37732,- - - -,1026,Host Sweep,- - - -,1,Inbound
08-13-05 17:27:25 ,UDP: Host Sweep,xx.ccc.158.ccc,37732,- - - -,1027,Host Sweep,- - - -,1,Inbound
08-13-05 17:27:26 ,IM: Yahoo Messenger Alive,yyy.19.208.155,- - - -,fff.141.ll.jjj,- - - -,Exploit,- - - -,2,Outbound
08-13-05 17:28:59 ,UDP: Host Sweep,zzz.83.153.179,37523,- - - -,1027,Host Sweep,- - - -,1,Inbound
08-13-05 17:28:59 ,UDP: Host Sweep,zzz.83.153.179,37523,- - - -,1026,Host Sweep,- - - -,1,Inbound
08-13-05 17:29:27 ,IM: Yahoo Messenger Alive,yyy.19.208.155,- - - -,fff.141.ll.jjj,- - - -,Exploit,- - - -,2,Outbound
08-13-05 17:31:27 ,IM: Yahoo Messenger Alive,yyy.19.208.155,- - - -,fff.141.ll.jjj,- - - -,Exploit,- - - -,2,Outbound
08-13-05 17:31:58 ,UDP: Host Sweep,zzz.66.104.140,44664,- - - -,1026,Host Sweep,- - - -,1,Inbound
08-13-05 17:31:58 ,UDP: Host Sweep,zzz.66.104.140,44664,- - - -,1027,Host Sweep,- - - -,1,Inbound
08-13-05 17:31:59 ,UDP: Host Sweep,sss.208.168.145,59990,- - - -,1027,Host Sweep,- - - -,1,Inbound
08-13-05 17:31:59 ,UDP: Host Sweep,sss.208.168.145,59990,- - - -,1026,Host Sweep,- - - -,1,Inbound
08-13-05 17:32:48 ,WORM: W32/Netsky.c@MM Worm,xx.197.169.ddd,50345,yyy.19.5.26,25,Exploit,smtp,1,Inbound
08-13-05 17:32:48 ,WORM: Possible Worm Detected in Attachment,xx.197.169.ddd,50345,yyy.19.5.26,25,Exploit,smtp,1,Inbound
08-13-05 17:33:27 ,IM: Yahoo Messenger Alive,yyy.19.208.155,- - - -,fff.141.ll.jjj,- - - -,Exploit,- - - -,2,Outbound
08-13-05 17:34:48 ,WORM: W32/Netsky.c@MM Worm,xx.197.169.ddd,- - - -,yyy.19.5.26,- - - -,Exploit,smtp,10,Inbound
08-13-05 17:34:48 ,WORM: Possible Worm Detected in Attachment,xx.197.169.ddd,- - - -,yyy.19.5.26,- - - -,Exploit,smtp,10,Inbound
08-13-05 17:35:27 ,IM: Yahoo Messenger Alive,yyy.19.208.155,- - - -,fff.141.ll.jjj,- - - -,Exploit,- - - -,2,Outbound
08-13-05 17:35:29 ,WORM: Possible Worm Detected in Attachment,zzz.221.109.26,63779,yyy.19.5.26,25,Exploit,smtp,1,Inbound
08-13-05 17:35:29 ,WORM: W32/Netsky.d@MM Worm,zzz.221.109.26,63779,yyy.19.5.26,25,Exploit,smtp,1,Inbound
08-13-05 17:37:27 ,IM: Yahoo Messenger Alive,yyy.19.208.155,- - - -,fff.141.ll.jjj,- - - -,Exploit,- - - -,2,Outbound
08-13-05 17:37:30 ,WORM: W32/Netsky.d@MM Worm,zzz.221.109.26,- - - -,yyy.19.5.26,- - - -,Exploit,smtp,1,Inbound
08-13-05 17:39:09 ,IM: MSN (.NET) Messenger Alive,yyy.19.210.eee,1322,ii.54.239.80,1863,Exploit,- - - -,1,Outbound
08-13-05 17:39:09 ,IM: MSN Messenger Server Lookup,yyy.19.5.24,34078,hhh.kk.66.75,53,Exploit,dns,1,Outbound
08-13-05 17:39:10 ,IM: MSN (.NET) Messenger Alive,yyy.19.210.eee,1323,hhh.kk.2.44,1863,Exploit,- - - -,1,Outbound
08-13-05 17:39:12 ,IM: Yahoo Messenger Alive,yyy.19.210.eee,1332,fff.141.ll.74,20,Exploit,- - - -,1,Outbound
08-13-05 17:39:19 ,UDP: Host Sweep,xx.ccc.158.123,34106,- - - -,1026,Host Sweep,- - - -,1,Inbound
08-13-05 17:39:19 ,UDP: Host Sweep,xx.ccc.158.123,34106,- - - -,1027,Host Sweep,- - - -,1,Inbound
08-13-05 17:39:28 ,IM: Yahoo Messenger Alive,yyy.19.208.155,- - - -,fff.141.ll.jjj,- - - -,Exploit,- - - -,3,Outbound
08-13-05 17:40:12 ,IM: Yahoo Messenger Alive,yyy.19.210.eee,1332,fff.141.ll.74,20,Exploit,- - - -,1,Outbound
08-13-05 17:41:28 ,IM: Yahoo Messenger Alive,yyy.19.210.eee,- - - -,fff.141.ll.74,- - - -,Exploit,- - - -,1,Outbound
08-13-05 17:ll:38 ,UDP: Host Sweep,yyy.19.5.24,34078,- - - -,53,Host Sweep,- - - -,1,Outbound
08-13-05 17:43:40 ,WORM: Possible Worm Detected in Attachment,aaa.1.193.107,55138,yyy.19.5.26,25,Exploit,smtp,1,Inbound
08-13-05 17:43:kk ,WORM: Possible Worm Detected in Attachment,yyy.19.5.26,35856,gg.118.195.9,25,Exploit,smtp,1,Outbound
08-13-05 17:54:30 ,UDP: Host Sweep,xx.ccc.158.123,34106,- - - -,1026,Host Sweep,- - - -,1,Inbound
08-13-05 17:54:30 ,UDP: Host Sweep,xx.ccc.158.123,34106,- - - -,1027,Host Sweep,- - - -,1,Inbound
08-13-05 17:55:00 ,TCP: SYN Host Sweep,bbb.11.167.ddd,- - - -,- - - -,25,Host Sweep,- - - -,1,Inbound


+---------------------------------------------------------------------
| はまもと(Microsoft MVP Windows - Security)
| ■地域密着型情報セキュリティ勉強会
| セキュリティもみじ
| http://d.hatena.ne.jp/sec-momiji/
| ■ハニーポッターの部屋
| http://d.hatena.ne.jp/connect24h/
| ■24 時間常時接続メーリングリスト「connect24h」開催中
| http://d.hatena.ne.jp/connect24h/20000514
| ■セカンダリDNS互助会
| http://d.hatena.ne.jp/connect24h/20000307
+----------------------------------------------------------------------



--[PR]------------------------------------------------------------------
■　無料サンプルで実感してみたい！育毛剤『髪之助』の人気の秘密は？　■
※─┬─┬─┬─┬─┬─┬─┐┏━┓━┓━┓＿＿＿＿＿＿＿＿＿＿＿＿＿
│男│女│兼│用│育│毛│剤│┃髪┃之┃助┃ 無料サンプルプレゼント！
└─┴─┴─┴─┴─┴─┴─※┗━┛━┛━┛￣￣￣￣￣￣￣￣￣￣￣￣￣
詳細はこちら！＞ http://ad.freeml.com/cgi-bin/ad.cgi?id=d56sl
------------------------------------------------------------------[PR]--
■GMO INTERNET GROUP■ GMO INTERNET www.gmo.jp