## 3 Selected Datasets
### Kdd 99  
The KDD 99 dataset comprises a comprehensive collection of 25,192 TCP/IP connections (observations) derived from a simulated LAN environment resembling a typical US Air Force setup. This network was specifically designed to mimic real-world conditions and was subjected to various attacks to create a diverse dataset. In this context, a connection refers to a sequence of TCP packets transmitted between a source IP address and a target IP address under a well-defined protocol. These connections are characterized by their start and end duration, along with the data exchanged. Each connection is labeled as either \"normal\" or \"anomalous\" based on its behavior. Each recorded connection contains approximately 100 bytes of data. A total of 41 features are extracted from each TCP/IP connection, consisting of 38 quantitative features and 3 qualitative features. The class variable, which determines if a connection is considered an intrusion or not, has two categories: \"Normal\" and \"Anomalous\". To provide a comprehensive overview of the dataset features, Tables 1 and 2 present a list of these features along with brief descriptions. The features are categorized as \"Basic\", \"Content-based\", \"Time-based\", and \"Connection-based\". Additionally, the tables indicate whether each feature is \"Continuous\" (C) or \"Discrete\" (D) in nature.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Name** & **Type** & **Description** \\ \hline
**Basic Features** & & \\ \hline Duration & C & Length of the connection \\ Protocol-type & D & Type of protocol \\ Service & D & Network service at the dest. \\ Flag & D & Normal or error status of \\  & & the connection \\ Src-bytes & C & N. of data bytes from source to destination \\ Dst-bytes & C & N. of data bytes from destination to source \\ Land & D & 1 if connection is from/to the same host/port; 0 otherwise \\ Wrong fragment & C & N. of “wrong” fragments \\ Urgen & C & N. of urgent packets \\ \hline
**Content-based Features** & & \\ \hline Hot & C & N. of “hot” indicators \\ Num-failed-logins & C & N. of failed login attempts \\ Logged-in & D & 1 if successfully logged-in; 0 otherwise \\ Num-compromised & C & N. of compromised conditions \\ Root-shell & D & 1 if root-shell is obtained; 0 otherwise \\ Su-attempted & D & 1 if “su root” command \\ Num-root & C & N.of “root” accesses \\ Num-file-creations & C & N. of file creation operations \\ Num-shells & C & N. of shell prompt \\ Num-access-files & C & N. of operations on access control files \\ Num-outbound-cmds & C & N. of outbound commands in an FTP session \\ Is-host-login & D & 1 if login belongs to the “hot” list; 0 otherwise \\ Is-guest-login & D & 1 if the login is a “guest” login; 0 otherwise \\ \hline \hline \end{tabular}
\end{table}
Table 1: Features Description KDD 99 part 1.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Name** & **Type** & **Description** \\ \hline
**Time-based Features** & & \\ \hline Count & C & N. of connect. to the same host as the current connect. in the past 2 s \\ Srv-count & C & N. of connect. to the same service as the current connection. in past 2 s. \\ Serror-rate & C & \% of connect. that have SYN errors (same-host connect.) \\ Srv-error-rate & C & \% of connect. that have SYN errors (same-service connect.) \\ Rerror-rate & C & \% of connect. that have RE) errors (same-host connect.) \\ Srv-error-rate & C & \% of connect. that have RE) errors (same-service connect.) \\ Same-svr-rate & C & \% of connect. to the same service (same-host connect.) \\ Diff-svr-rate & C & \% of connect. to different services (same-host connect.) \\ Srv-diff-host-rate & C & \% of connect. to different hosts (same-service connect.) \\ \hline \hline \end{tabular}
\end{table}
Table 2: Features Description KDD 99 part 2.