R - Extracting all Factors except empty element ""

17/09/09 15:00 Filed in: R Language | statistics

Scenario: In a project I’m working on, there are security attacks shown in system logs. As part of the log data, snort alerts, there is a class type which is the general category or classification of an attack. In some cases, the attack type is apparently unknown and comes out as an “empty”. There are times I want to see everything but the unknown attack types.


# lists the types of attacks found in the data - based on Classtype
classtypes = factor( snortabbrev$Classtype )

some factors come back with an empty element such as:

> levels(classtypes)
[1] ""                         "attempted-admin"          "attempted-recon"          "attempted-user"           "misc-activity"            "misc-attack"              "protocol-command-decode"
[8] "unsuccessful-user"        "web-application-activity"
> as.matrix(levels(classtypes))
      [,1]                     
 [1,] ""                       
 [2,] "attempted-admin"        
 [3,] "attempted-recon"        
 [4,] "attempted-user"         
 [5,] "misc-activity"          
 [6,] "misc-attack"            
 [7,] "protocol-command-decode"
 [8,] "unsuccessful-user"      
 [9,] "web-application-activity"
>

Here's how to get rid of the "" if you don't want to consider it:

> levels(classtypes) != ""
[1] FALSE  TRUE  TRUE  TRUE  TRUE  TRUE  TRUE  TRUE  TRUE
> classtypes_culled = levels(classtypes)[ levels(classtypes) != ""]
[1] "attempted-admin"          "attempted-recon"          "attempted-user"           "misc-activity"            "misc-attack"              "protocol-command-decode"  "unsuccessful-user"      
[8] "web-application-activity"
> 

> as.matrix( classtypes_culled )
     [,1]                     
[1,] "attempted-admin"        
[2,] "attempted-recon"        
[3,] "attempted-user"         
[4,] "misc-activity"          
[5,] "misc-attack"            
[6,] "protocol-command-decode"
[7,] "unsuccessful-user"      
[8,] "web-application-activity"
>

asdfasdf