Table 17 Top 20 features for SQL Injection web attacks ranked by Supervised-based Feature Importance Lists
From: A new feature popularity framework for detecting cyberattacks using popular features
XGBoost | Random Forest | CatBoost | LightGBM |
|---|---|---|---|
Max_Packet_Length | BwdPktLenMax | ECE_Flag_Count | Flow_IAT_Min |
BwdPktLenMax | Flow_Packets_s | Fwd_IAT_Max | Flow_Bytes_s |
Bwd_IAT_Min | Flow_IAT_Mean | PSH_Flag_Count | Fwd_IAT_Min |
TotLenFwdPkts | RST_Flag_Count | Max_Packet_Length | BwdPktLenStd |
RST_Flag_Count | FwdPktLenMax | Total_Fwd_Packets | Bwd_Packets_s |
Packet_Length_Mean | AvgBwdSegSize | Bwd_IAT_Max | Bwd_IAT_Min |
Flow_IAT_Max | Total_Backward_Packets | Subflow_Bwd_Bytes | FwdPktLenMean |
Fwd_Header_Length | Max_Packet_Length | BwdPktLenStd | Fwd_IAT_Total |
FwdPktLenStd | ECE_Flag_Count | AvgBwdSegSize | Flow_IAT_Mean |
Bwd_Packets_s | BwdPktLenMean | FwdPktLenMax | FwdPktLenMax |
Packet_Length_Std | Subflow_Bwd_Packets | Subflow_Bwd_Packets | Flow_Packets_s |
Bwd_IAT_Max | Fwd_IAT_Total | Bwd_Header_Length | Flow_IAT_Max |
FwdPktLenMax | BwdPktLenStd | TotLenBwdPkts | Fwd_IAT_Mean |
Flow_Bytes_s | Fwd_IAT_Max | Down_Up_Ratio | TotLenFwdPkts |
Bwd_IAT_Mean | FwdPktLenMean | FwdPktLenStd | |
Fwd_IAT_Std | Flow_IAT_Std | Fwd_Packets_s | |
Fwd_IAT_Min | min_seg_size_forward | Fwd_IAT_Std | |
FwdPktLenMean | PktLenVar | Flow_IAT_Std | |
Flow_Packets_s | Packet_Length_Std | Fwd_IAT_Max | |
Fwd_IAT_Mean | Flow_IAT_Max | PktLenVar |