# NTARC: A Data Model for the Systematic Review of Network Traffic Analysis Research
## 3 NTARC Data Structures  
An NTARC object is a digital summary of a peer-reviewed NTA scientific publication. NTARC publications are required to fit the scheme shown in Figure 1. Additionally, every NTARC object must be compliant with the NTARC model, which follows the structure depicted in Figure 2.  
NTARC uses the JSON format [33], which can be easily parsed and written by computers while still being human readable. Creating, sharing, and distributing NTARC data are simple and straightforward  
Figure 2: Tree-like scheme of an NTARC object. The major subtrees are: reference, which contains the data for identifying the scientific work and metadata describing the details of the NTARC object curation; data, which describes the datasets used; preprocessing, which contains selected features and feature transformations; analysis method, describing the analysis algorithms used; evaluation, depicting the evaluation metrics; result, summarizing the claimed results, improvements, and reproducibility of the scientific work; version, which specifies the NTARC version used for this object. since JSON files are text-based, and each file addresses only one scientific publication. A first, minimal prototype was used for the research conducted in [34]. The readers will notice that fields defined in the NTRC structure are exhaustive. For the sake of flexibility and time optimization, some fields in the structure are mandatory, and other fields are optional. Furthermore, contributors are free to define their own fields that might be added to future NTRC versions or will simply remain as notes. The NTRC model consists of six main blocks: reference, data, preprocessing, analysis_method, evaluation, and results. Additionally, a version field stores the NTRC version that corresponds to the JSON object. The version field helps automated tools during parsing processes and makes the format future-proof. The main blocks are described as follows:  
* The reference block: This block collects information that identifies the scientific work, the publication media, and the curation process itself. * The data block: This block stores information about the network traffic data used. It is not intended to refer to the original dataset version, but the version retrieved by the paper authors, which might have been modified. Here, we find one of the anchors that facilitates comparative analysis, since the scope of the data is always NTA and is provided in the shape of either packet captures, flow records, or preprocessed data derived from packet captures or flow records. The data block consists of one or several datasets. By definition, two datasets must be reported separately when they clearly come from different setups, projects, or sensor environments; otherwise, they must be defined as subsets. * The preprocessing block: This block summarizes all transformation and modification processes that datasets underwent previous to the main analysis (e.g., normalization, dimensionality reduction, feature extraction, filtering). The stored information is limited to the preprocessing specifically mentioned in the paper as a part of the presented methodology. This block also captures the set of network traffic features and/or flow keys that were used to represent traffic during subsequent analysis. Most fields in this block are binary and mandatory, allowing a fast curation of relevant preprocessing aspects. Subsequent blocks (e.g., feature_selections, packets, flows, and flow_aggregations) are optional, being suitable for cases where a more detailed, fine-grained definition is desired. Specifically, packets, flows, and flow_aggregations are blocks that indicate the type of traffic objects to analyze during experiments. The habitual trend is focusing on only one of these traffic objects. * The analysis_method block: This block depicts the analysis. It captures relevant details of the analysis methodology and identifies the algorithms used. Note that here, tools are repeated at two context levels: general for the analysis method and specific for algorithms.