Table 2 26 statistical features.
No. | Feature name | Description of features |
|---|---|---|
1 | Num pkts | Total number of traffic packs streamed |
2 | Avg ICMP pkt | Average number of ICMP traffic packets in the stream |
3 | Avg UDP pkt | Average number of UDP traffic packets in the stream |
4 | Avg DNS pkt | Average number of DNS traffic packets in a stream |
5 | Avg TCP pkt | Average number of TCP traffic packets in the stream |
6 | Avg syn flag | Average number of traffic packets with the syn flag bit in the stream |
7 | Avg urg flag | Average number of traffic packets in the stream with the urg flag bit |
8 | Avg fin flag | Average number of traffic packets with fin flag bits in the stream |
9 | Avg psh flag | Average number of traffic packets with the psh flag bit in the stream |
10 | Avg rst flag | Average number of traffic packets with the rst flag bit in the stream |
11 | Avg ack flag | Average number of traffic packets with the ack flag bit in the stream |
12 | Duration windows flow | Holding time for the entire stream |
13 | Avg delta time | The average size of the incremental time in the flow, the incremental time being the time between two flow packets |
14 | Min delta time | Minimum value of incremental time in the stream |
15 | Max delta time | Maximum value of incremental time in the stream |
16 | StDev delta time | Variance of the incremental time in the stream |
17 | Avg pkts length | Average size of traffic packets in a stream |
18 | Min pkts length | The smallest packet size in the stream |
19 | Max pkts length | Maximum packet size in the stream |
20 | StDev pkts length | Standard deviation of the flow packet length in the stream |
21 | Avg small payload pkt | Average number of traffic packets with less than 32 bytes of payload in the stream |
22 | Avg payload | Average value of payload in stream |
23 | Min payload | Minimum value of payload in stream |
24 | Max payload | Max. payload in stream |
25 | StDev payload | Standard deviation of the payload in the stream |
26 | Avg DNS and TCP | Share of DNS and TCP in the stream |
