R - Showing a frequency table in a matrix format

17/09/09 15:09 Filed in: R Language | statistics

Scenario - Attack types in Snort IDS, class types, are reported in the event logs. To get a frequency analysis, after parsing the log data into “R”, I can extract the classtypes of all the log entries. From that it’s handy to get a frequency table showing how many times a particular classification of attack occurred. But the output format is not very readable or easy to parse by other scripts. This recipe shows how to dump a frequency table as a 2-column matrix.

# lists the types of attacks found in the data - based on Classtype
> classtypes = factor( snortabbrev$Classtype )

> str(classtypes)
 Factor w/ 9 levels "","attempted-admin",..: 4 4 6 6 6 6 2 2 6 6 ...

> table(classtypes)
classtypes
                                  attempted-admin          attempted-recon           attempted-user            misc-activity              misc-attack 
                      18                       93                       35                       21                       30                       12 
 protocol-command-decode        unsuccessful-user web-application-activity 
                       2                        2                      287 

> as.matrix(table(classtypes))
                         [,1]
                           18
attempted-admin            93
attempted-recon            35
attempted-user             21
misc-activity              30
misc-attack                12
protocol-command-decode     2
unsuccessful-user           2
web-application-activity  287

Works just as well with a summary command

> as.matrix(summary(classtypes))
                         [,1]
                           18
attempted-admin            93
attempted-recon            35
attempted-user             21
misc-activity              30
misc-attack                12
protocol-command-decode     2
unsuccessful-user           2
web-application-activity  287

asdfasdf