## 3 Selected Datasets
### Cse-Cic-IDS 2018  
This dataset encompasses a comprehensive collection of observations, encompassing both normal network traffic and 14 distinct types of attacks: SHH Brute Force, SQL Injection, Infiltration, FTP Brute Force, DoS attacks Slowloris, DoS attacks Slow HTTP Test, DoS attacks Hulk, DoS attacks GoldenEye, DDoS attacks LOIC UDP, DDoS attacks LOIC HTTP, DDoS attacks HOIC, Brute Force XSS, Brute Force Web, and Bot. The attacking infrastructure involved in this dataset consists of 50 machines, while the victim organization comprises 5 departments with 420 machines and 30 servers. The dataset includes network traffic and system logs from each machine, with 75 features extracted from the captured traffic using CICFlowMeter-V3. CICFlowMeter-V3, a Java-based network traffic flow generator, offers flexibility in feature selection, addition, and control over the flow timeout duration. Within the CSE-CIC-IDS 2018 dataset, profiles are employed to systematically generate datasets. These datasets provide intricate intrusion descriptions and abstract distribution models for applications, protocols, or lower-level network entities. The finalized dataset is presented in CSV format, with each flow represented by four columns: Destination Port, Protocol, Timestamp, and over 75 network traffic features mentioned previously. A total of \begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Name** & **Type** & **Description** \\ \hline \hline
**Connection-based Features** & & \\ \hline ct\_srv\_src & I & N. of connect. that contain the same service and dest. \\  & & in address 100 connect. according to the last time \\ ct\_srv\_dst & I & N. of connect. of the same dest. address in 100 connect. \\  & & according to the last time \\ ct\_dst\_ltm & I & N. of connect. of the same source address in 100 connect. \\  & & according to the last time \\ ct\_src\_dport\_ltm & I & N. of connect. of the same source address \\  & & and the dest. port in 100 connect. according to the last time \\ ct\_dst\_sport\_ltm & I & N. of connect. of the same dest. address \\  & & and the source port in 100 connect according to the last time \\ ct\_dst\_src\_ltm & I & N. of connect. of the same source and the dest. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Features Description UNSW-NB15 part 2. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Name** & **Type** & **Description** \\ \hline \hline
**Content-based Features** & & \\ \hline swin & I & Source TCP window advert. \\ \hline dwin & I & Dest. TCP window advert. \\  step & I & 1 Source TCP sequence num. \\ \hline dtcpb & I & Dest. TCP sequence num. \\ \hline means & I & Mean of the flow packet size transmitted by the src \\ \hline means & I & Mean of the flow packet size transmitted by the dst \\ \hline trans\_depth & I & Depth into the connection of http request/response transaction \\ \hline res\_bdy\_len & I & Size of the data transferred from the server’s http service \\ \hline \hline
**Time-based Features** & & \\ \hline sjit & F & Source jitter \\ \hline djit & F & Dest. jitter \\ \hline time & T & Record start time \\ \hline lime & T & Record last time \\ \hline sintpkt & F & Source inter-packet arrival time \\ \hline dintpkt & F & Dest. inter-packet arrival time \\ \hline tcptt & F & The sum of “synack” and “ackdat” of the TCP \\ \hline synack & F & Time between the SYN and the SYN\_ACK packets of the TCP \\ \hline ackdat & F & Time between the SYN\_ACK and the ACK packets of the TCP \\ \hline \hline
**General purpose Features** & & \\ \hline is\_sm\_ips\_ports & B & If source equals to dest. IP addresses and port n. are equal, it is 1 \\ \hline ct\_state\_ttl & I & N. for each state according to specific range of values \\ \hline ct\_hw\_http\_mthd & I & N. of flows that has methods such as Get and Post in HTTP service \\ \hline is\_ftp\_login & B & If the ftp session is accessed by user and password then 1 else 0 \\ \hline ct\_ftp\_cmd & I & N. of flows that has a command in ftp session \\ \hline \hline \end{tabular}
\end{table}