I was advised to ask my question here.
Recently, I made a post about finding suitable dataset for SIEM (Security Information and Event Management) systems. The goal was to work on classification and correlation to detect security attacks.
I decided to use the dataset from the Honeynet Project Challenges. The problem is this: I don't know if I should use the whole dataset set for my project, because if you look, for example, at the KDD99 dataset, it is devised into two parts: 10% for training and 90% for testing.
I have seen some researcher use dataset A for training and dataset B for testing, do you have any other ideas? I am really stuck at the part of training vs. testing
If my question is too broad. I don't mind some reading materials that will help me deal with my dataset.