## 4 Results
### Evaluation Results
In the CICIDS-2017 dataset, the \"Destination Port\" and packet metrics similar to \"Init_Win_Bytes_Backward\" are emphasized, pointing to the importance of monitoring port activities and traffic patterns for intrusion detection. Similarly, for the NSL-KDD dataset, features focusing on service consistency across hosts, like \"dst_host_same_srv_rate\" and \"dst_host_srv_count\", are pivotal. This consolidated feature ranking serves as a valuable resource for security analysts, enabling them to monitor these features in network traffic even when the common attack type is not known beforehand. Detailed explanations of these common top intrusion features are provided in Appendix A. **Feature Importance for Each Attack Type:** We proceed to analyze the intrusion-specific feature importance, focusing on the top five features associated with each attack type. Tables 10 and 11 present these lists for the RoEduNet-SIMARGL2021 and CICIDS-2017 datasets, respectively. In our observations, we note that, across both datasets, certain features emerge consistently across different attack types. For instance, features like TCP_WIN_SCALE_IN and FLOW_DURATION_MS for RoEduNet-SIMARGL2021 and Destination Port and Init_Win_Bytes_Bwd for CICIDS-2017 are recurrently prominent. For the NSL-KDD dataset, as depicted in Table 12, the feature _dst_host_same_src_port_rate_ consistently ranks high across various attack types, such as Probe, R2L, and U2R, underlining its significance in diverse intrusion scenarios. Similarly, features like _hot_ and _dst_host_count_ appear prominently across multiple attack categories. These findings provide crucial insights for analysts when investigating specific network intrusions, guiding them to focus on particular parameters associated with each attack type. Moreover, this knowledge can inform the development of attack-specific solutions for intrusion detection systems (IDSs), leveraging feature awareness for different network intrusion types. **Common Features Among Datasets:** We finally show the common intrusion features that we found in the three datasets. Table 13 shows such common features. Although the three datasets use different features to describe network traffic, we conducted manual scrutiny of each feature's documentation description in [34; 63; 64] to identify equivalent features between datasets. Although the datasets have different characteristics, we took this extra step to show the common network traffic features among them. Such an analysis is important because, even if our framework is dataset-agnostic and flexible, this experiment shows that we can still recognize some network traffic patterns (features) among different testbeds for network intrusion detection. Thus, these network traffic features should be monitored by the security analyst managing the network. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Feature** & **Normal** & **DoS** & **Port Scan** \\
2 & **TCP\_WIN\_SCALE\_IN** & TCP\_WIN\_SCALE\_IN & TCP\_WIN\_SCALE\_IN \\
2 & **TCP\_WIN\_MAX\_OUT** & TCP\_WIN\_MIN\_IN & FLOW\_DURTATION\_MS \\
3 & **FLOW\_DURTATION\_MS** & TCP\_WIN\_MAX\_IN & TCP\_WIN\_MAX\_IN \\
4 & **TCP\_WIN\_MIN\_OUT** & FLOW\_DURTATION\_MS & TCP\_WIN\_MAX\_OUT \\
5 & **TCP\_WIN\_MAX\_IN** & TCP\_FLAGS & TCP\_WIN\_MIN\_IN \\ \hline \hline \end{tabular}
\end{table} 
Table 10: The feature importance, indicated by the top five features for each attack type for the RoEduNet-SIMARGL2021 dataset, shows _TCP\_WIN\_SCALE\_IN_ as the predominant feature across all attack types.