Skip to main content

Table 3 Selected features of NSL-KDD [13] and UNSW-NB15 [27] datasets

From: A hybrid machine learning method for increasing the performance of network intrusion detection systems

Dataset

Class

Filter method

Wrapper method

Selected features

NSL-KDD [13]

DoS

14

8

'src_bytes', 'dst_bytes', 'wrong_fragment', 'num_compromised', 'same_srv_rate', 'dst_host_serror_rate', 'dst_host_srv_serror_rate', 'service_ecr_i'

Probe

21

14

'src_bytes', 'dst_bytes', 'count', 'rerror_rate', 'dst_host_same_srv_rate', 'dst_host_diff_srv_rate', 'dst_host_same_src_port_rate', 'dst_host_rerror_rate', 'service_finger', 'service_ftp_data', 'service_http', 'service_private', 'service_smtp', 'service_telnet'

R2L

15

14

'duration', 'src_bytes', 'dst_bytes', 'hot', 'num_failed_logins', 'num_root', 'num_access_files', 'dst_host_count', 'dst_host_srv_count', 'dst_host_same_srv_rate', 'dst_host_same_src_port_rate', 'dst_host_srv_diff_host_rate', 'service_ftp_data', 'service_imap4'

U2R

14

4

'src_bytes', 'dst_bytes', 'hot', 'root_shell'

NSL-KDD [13]

Attack–normal

31

4

'src_bytes', 'dst_host_same_srv_rate', 'service_ecr_i', 'service_http'

UNSW-NB15 [27]

Attack–normal

25

11

'sbytes', 'sttl', 'sload', 'sinpkt', 'dinpkt', 'stcpb', 'tcprtt', 'synack', 'smean', 'ct_srv_src', 'ct_srv_dst'