# Analysis of Lightweight Feature Vectors for Attack Detection in Network Traffic
## 5 Results and Discussion
### Preprocessing Performance  
Table 4 shows the extraction and preprocessing times obtained by a machine with the following characteristics: 4x Intel(R) Core(TM) i5-4300 CPU @ 1.90 GHz, Memory: 4 GB, OS: Ubuntu 16.04 LTS, kernel Ubuntu 4.13.0-37 generic. It is worth remarking that the _timeout_ window adjusted for all vectors (i.e., the maximum time that a single flow or source is observed) was 60 s.  
Results present the TA vector and the Consensus vector as the fastest to extract. This fact is obviously consistent, as they are also the shortest ones (fewer features). The CAIA vector implies more features and therefore longer times. The extraction of AGM vectors is the slowest because, in spite of collecting very few features, the source observation (instead of flows) entails storing bigger hashes and more complex tree-like structures in the RAM of the preprocessing device. The AGM vector is therefore also more memory-space exhaustive than flow-based options during preprocessing phases.  
The Consensus and CAIA vectors imply an intermediate step to transform unidirectional flows into bidirectional flows. Similarly, the AGM vector requires an additional step to perform feature aggregation operations. Such extra steps are necessary due to the characteristics of the used feature-extraction tool, but in real implementations they can be incorporated in the extraction process, thus optimizing the preprocessing and reducing computational costs and times.  
\begin{table}
\begin{tabular}{c l l l l l} \hline \hline
**Top** & **Vector** & **Extraction** & **One2 bi** & **Aggreg.** & **GT-map.** \\ \hline
4 th/5 th & UNSW &? &? &? &? \\ \hline
3 rd & CAIA & 46 m 34 s & 04 m 21 s & — & 02 m 21 s \\ \hline
2 nd & Consensus & 41 m 49 s & 03 m 26 s & — & 02 m 07 s \\ \hline
1 st & TA & 41 m 32 s & — & — & 02 m 01 s \\ \hline
4 th/5 th & AGM & 58 m 37 s & — & 57 m 16 s & 29 m 17 s \\ \hline \hline \end{tabular}
\end{table}
Table 4: Feature extraction and preprocessing time costs.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Original** & **Set of Binary Features** \\ \hline dstIP & highly spread distribution \\  & _removed from analysis_ \\ \hline srcPort, mode\_srcPort & highly spread distribution \\  & _removed from analysis_ \\ \hline dstPort, mode\_dstPort & spread distribution: 53 (17.5\%), 80 (11.2\%), 5190 (5.7\%), 6881 (5.5\%), 111 (4.9\%), \\  & 25 (4.3\%), 143 (2.5\%), 22 (2.4\%), 21 (2.4\%), 179 (1.6\%), other (42.0\%) \\  & _removed from analysis_ \\ \hline state & FIN (71.7\%), CON (27.9\%), INT (0.4\%), REQ (0.1\%), CLO (0.0\%), FST (0.0\%), ACC \\  & (0.0\%), other (0.0\%) \\ \hline service & — (59.2\%), MS (17.2\%), http (9.3\%), ftp-data (6.1\%), smtp (3.8\%), ssh (2.3\%), ftp (2.2\%), \\  & poly (0.0\%), ssl (0.0\%), ssmp (0.0\%), dhcp (0.0\%), radius (0.0\%), ic (0.0\%), other (0.00\%) \\ \hline protocol, mode\_protocol & tcp (90.1\%), ospf (6.5\%), udp (2.4\%), icmp (1.1\%), other (0.0\%) \\ \hline mode\_TCPflag & ACK (82.5\%), PUSH-ACK (34.5\%), — (13.9\%), SYN (0.1\%) \\ \hline \hline \end{tabular}
\end{table}
Table 3: Nominal features and equivalent binary features.  
Due to its intrinsic characteristics, the UNSW vector is assumed to be slower than TA, Consensus, and CAIA, and perhaps similar to AGM. To extract features, the UNSW vector requires a deep inspection of flows and the operation of Bro, Argus, and 12 different developed models [5].  
Although they are not relevant for the implementation, Table 4 also provides the times to assign labels to vectors for the final evaluation (GT-mapping). AGM requirements are higher here due to the fact that the available ground truth file depicts flows. The AGM vector works with sources and therefore requires further operations compared to its competitors.  
Briefly expressed, in terms of computational times, the TA vector is the fastest and the AGM vector the slowest.