Table 2 Feature subsets selected by MCP algorithm in five datasets.

From: An IoT intrusion detection framework based on feature selection and large language models fine-tuning

Dataset

Features

NF-CSE-CIC-IDS2018-v2

CLIENT_TCP_FLAGS, DNS_TTL_ANSWER, MAX_TTL, L4_DST_PORT, SHORTEST_FLOW_PKT, SRC_TO_DST_AVG_THROUGHPUT, IN_PKTS, SERVER_TCP_FLAGS, TCP_WIN_MAX_IN, DST_TO_SRC_AVG_THROUGHPUT

NF-ToN-IoT-v2

TCP_WIN_MAX_IN, TCP_WIN_MAX_OUT, FLOW_DURATION_MILLISECONDS, L4_DST_PORT, DST_TO_SRC_AVG_THROUGHPUT, L7_PROTO, IN_BYTES

NF-UNSW-NB15-v2

MAX_TTL, ICMP_TYPE, L4_DST_PORT, TCP_FLAGS, MAX_IP_PKT_LEN, L7_PROTO, PROTOCOL, SRC_TO_DST_AVG_THROUGHPUT, OUT_BYTES

NF-BoT-IoT-v2

L4_SRC_PORT, DURATION_OUT, RETRANSMITTED_OUT_PKTS, CLIENT_TCP_FLAGS, NUM_PKTS_256_TO_512_BYTES, TCP_FLAGS, NUM_PKTS_UP_TO_128_BYTES, NUM_PKTS_1024_TO_1514_BYTES, SRC_TO_DST_SECOND_BYTES

CIC-ToN-IoT

Src Port, Dst Port, Init Fwd Win Byts, Init Bwd Win Byts, Idle Min, Bwd Pkt Len Mean, Pkt Len Min, Flow IAT Mean, Idle Max, Active Max, Bwd IAT Std, Active Std, Fwd Act Data Pkts

Back to article page