Table 1 List of features used in this work.
From: Measuring and classifying IP usage scenarios: a continuous neural trees approach
Group | # Features | Features |
|---|---|---|
Geolocation | 20 | Number of IPs, number of landmarks, ratio of landmarks, average number of landmark history locations, landmark covered area radius, number of landmark covered districts, number of landmark covered cities, number of landmark covered provinces/states, average of the ratios of every landmark history covered area to the block covered area, length of IP block prefix (e.g., the 24 in 192.168.0.1/24), block province/state, block province/state area, block province/state GDP, block province/state population, block province/state population density, block city, block city area, block city GDP, block city population, block city population density. |
Traceroute | 4 | Number and ratio of reachable IPs, number and ratio of IPs appearing in a routing path. |
Port | 16 | Numbers and ratios of alive port for port 80, port 443, port 21, port 22, port 23, port 53, and ports for email services (including port 25, port 465, port 143, port 993, port 110, and port 995), number of ICMP alive IPs, ratio of ICMP alive IPs. |
Domain | 3 | Average number of block IP main domain names, number of IP domain names, ratio of IP domain names. |
WHOIS | 3 | Number of WHOIS IPs (e.g., 65536 and 32768), WHOIS registration netname, WHOIS registration organization name. |
