# Analysis of Lightweight Feature Vectors for Attack Detection in Network Traffic
## 4 Experiments
### Experimental Design and Setup  
Step-by-step experiments were (scheme in Figure 2): \begin{table}
\begin{tabular}{l l} \hline \hline
**Global** & \\ \hline Total flows & 2,540,038 \\
0-legitimate & 2,218,755 \\
1-attacks & 321,283 \\ \hline \hline
**Attacks** & \\ \hline
1-fuzzers & 24,246 \\
2-reconnaissance & 13,987 \\
3-shellcode & 1511 \\
4-analysis & 2677 \\
5-backdoor & 2329 \\
6-DoS & 16,353 \\
7-exploits & 44,525 \\
8-generic & 215,481 \\
9-worms & 174 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The UNSW-NB15 dataset statistics. Figure 2: Scheme of the conducted experiment. 1. **Basic Feature Extraction** Features were obtained from pcaps with a feature extractor developed in Golang. The process was the same for the CAIA, Consensus, Time-Activity (TA), and AGM vectors. As for the UNSW-NB15 Argus/Bro case, we directly used the published preprocessed data. The UNSW-NB15 Argus/Bro requires the use of Argus and Bro tools, in addition to 12 models that have not been published in the consulted sources. Due to the fact that the UNSW-NB15 format consists of a higher number of features (also more costly to extract) than the other vectors, we assumed that the UNSW-NB15 Argus/Bro vector is one of the most resource-demanding vectors for the extraction-cost comparison. Another special case is the AGM format, which requires a specific _aggregation-step_ to transform the 8 basic features into the defined AGM vector with 22 features. In order to allow a fair comparison, CAIA and Consensus vectors, which are _bidirectional_ defined, underwent an additional phase to convert unidirectional vectors into bidirectional vectors (uni2 bi). Finally, the AGM format, which addresses source-behavior instead of flow-behavior (in the context of this work, a \"flow\" is defined by the classic 5-tuple format: srcIP, dstIP, srcPort, dstPort and protocol), required a conversion to unfold its samples and match the flow-key used by the other four vectors (h2f). 2. **GT Mapping** Extracted data in the different formats were cross-checked with the GT file to assign the corresponding labels to training and test datasets. There are two types of labels: Binary (0-legitimate, 1-attack) and multiclass (identifying the nine attack families contained in the used dataset). In this step, all flows were initially labeled as \"legitimate\" (i.e., 0-label), and later labels were overwritten whenever processed flows appeared in the GT file. The mapping script used flow-keys and timestamps to find the correct matching between flows and threats. The corresponding statistics are in Table 2.
3. **Extension to Numerical Vectors** In order to analyze data with purely numerical classification schemes, nominal variables were transformed into _dummy_ variables [19]. To avoid the generation of high-dimensional sparse spaces, we used the method proposed in Reference [16], which explores the distribution of training data with frequency tables and creates variables accordingly. We also intentionally removed srcPort and dstPort from analyzed vectors to dissociate our experiments from port-based analysis. In any case, srcPort and dstPort showed low relevance or were directly negligible during preliminary experiments for all vectors. This fact does not necessarily mean that these features are not useful for discriminating traffic attacks; instead, they must be considered of low importance in the context of every vector, which might contain more revealing features highly correlated with port information (srcPort is usually irrelevant also from a general perspective). Removing srcPort and dstPort is also a good initiative from a perspective of analyzing encrypted traffic (see discussions in Sections 6 and 6.1). Table 3 shows the new binary variables created based on frequency tables. 4. **Proportional Scaling** We normalized features in training and test datasets according to training _max_ and _min_ values. We preferred proportional scaling before standardization to avoid the manipulation of original feature variances. 5.