Table 7 Top 20 CSE-CIC-IDS2018 features by supervised ranking technique: XGBoost, Random Forest; due to hyper-parameter settings, CatBoost uses only 14 features
From: Detecting cybersecurity attacks across different network features and learners
XGBoost | CatBoost | Random Forest |
|---|---|---|
Fwd_Packet_Length_Max | Destination_Port | Fwd_Packet_Length_Mean |
Fwd_IAT_Max | Flow_IAT_Min | Max_Packet_Length |
Total_Length_of_Fwd_Packets | Bwd_Packet_Length_Std | min_seg_size_forward |
Fwd_IAT_Std | min_seg_size_forward | Flow_IAT_Min |
Fwd_Packets_s | Fwd_Packet_Length_Max | Fwd_Packets_s |
Fwd_Header_Length | Fwd_IAT_Total | Total_Length_of_Fwd_Packets |
Fwd_Packet_Length_Mean | Fwd_Header_Length | Fwd_IAT_Min |
min_seg_size_forward | Fwd_Packets_s | Fwd_IAT_Total |
Bwd_IAT_Total | ACK_Flag_Count | Fwd_IAT_Max |
Idle_Min | Fwd_IAT_Min | Bwd_Packet_Length_Max |
Fwd_IAT_Total | Flow_Bytes_s | Flow_IAT_Mean |
Flow_IAT_Std | Avg_Fwd_Segment_Size | Fwd_Packet_Length_Max |
Bwd_Packet_Length_Std | Flow_IAT_Std | Total_Length_of_Bwd_Packets |
act_data_pkt_fwd | Flow_IAT_Max | Fwd_Header_Length |
PSH_Flag_Count | PSH_Flag_Count | |
Bwd_Packets_s | Flow_Packets_s | |
Max_Packet_Length | Down_Up_Ratio | |
RST_Flag_Count | Bwd_Packets_s | |
ACK_Flag_Count | Flow_IAT_Max | |
Flow_IAT_Max | Flow_IAT_Std |