## 3 Datasets and Features
### Unified Set with Meaningful Features
\begin{table}
\begin{tabular}{l l l} \hline \hline  & **Feature name** & **Description** \\ \hline
12 (r) & _CLIENT\_TCP\_FLAGS_ & _Cumulative of all client TCP flags_ \\ \hline
13 & SERVER\_TCP\_FLAGS & Cumulative of all server TCP flags \\ \hline
14 (m) & _FLOW\_DURATION_ & _Flow duration in milliseconds_ \\
15 (m) & _DURATION\_IN_ & _Incoming stream duration in millisecond_ \\
16 (m) & _DURATION\_OUT_ & _Outgoing stream duration in millisecond._ \\
17 (m) & _MIN\_TTL_ & _Minimal flow TTL_ \\
18 (m) & _MAX\_TTL_ & _Maximal flow TTL_ \\
19 (m) & _LONGEST\_FLOW\_PKT_ & _Longest packet (bytes) of the flow_ \\ \hline
20 & SHORTEST\_FLOW\_PKT & Shortest packet (bytes) of the flow \\
21 & MIN\_IP\_PKT\_LEN & Smallest flow IP packet len observed \\
22 & MAX\_IP\_PKT\_LEN & Largest flow IP packet len observed \\
23 & SRC\_TO\_DST\_SECOND\_BYTES & Src to dst bytes/sec \\
24 & DST\_TO\_SRC\_SECOND\_BYTES & Dst to src bytes/sec \\
25 & RETRANSMITTED\_IN\_BYTES & No. of retr. TCP flow bytes (src-dst) \\ \hline
26 (r) & _RETRANSMITTED\_IN\_PKTS_ & _No. of retr. TCP flow packets (src-dst)_ \\ \hline
27 & RETRANSMITTED\_OUT\_BYTES & No. of retr. TCP flow bytes (dst-src) \\ \hline
28 (r) & _RETRANSMITTED\_OUT\_PKTS_ & _No. of retr. TCP flow packets (dst-src)_ \\
29 (m) & _SRC\_TO\_DST\_AVG\_THROUGHPUT_ & _Src to dst average throughput (bps)_ \\
30 (m) & _DST\_TO\_SRC\_AVG\_THROUGHPUT_ & _Dst to src average throughput (bps)_ \\ \hline
31 & NUM\_PKTS\_UP\_TO\_128\_BYTES & Packets of IP size \(\leq\) 128 \\
32 & NUM\_PKTS\_128\_TO\_256\_BYTES & Packets of IP size \(>\) 128 \& \(\leq\)256 \\
33 & NUM\_PKTS\_256\_TO\_512\_BYTES & Packets of IP size \(>\) 256 \& \(\leq\)512 \\
34 & NUM\_PKTS\_512\_TO\_1024\_BYTES & Packets of IP size \(>\) 512 \& \(\leq\)1024 \\ \hline
35 (r) & _NUM\_PKTS\_1024\_TO\_1514\_BYTES_ & _Packets of IP size \(>\) 1024 \& \(\leq\)1514_ \\ \hline
36 & TCP\_WIN\_MAX\_IN & Max TCP Window (src-dst) \\
37 & TCP\_WIN\_MAX\_OUT & Max TCP Window (dst-src) \\ \hline
38 (r) & _ICMP\_TYPE_ & _ICMP Type - 256 + ICMP code_ \\ \hline
39 & ICMP\_IPV4\_TYPE & ICMP Type. \\
40 & DNS\_QUERY\_ID & DNS query transaction Id. \\
41 & DNS\_QUERY\_TYPE & DNS query type (e.g., 1 = A, 2 = NS etc.) \\ \hline
42 (m) & _DNS\_TTL\_ANSWER_ & _TTL of the first A record (if any)_ \\ \hline
43 & FTP\_COMMAND\_RET\_CODE & FTP client command return code \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._ \begin{table}
\begin{tabular}{l l l} \hline \hline
**Feature 1 (to Remove)** & **Feature 2 (Highly Cor.)** & **Corr. Coeff.** \\ \hline LONGEST\_FLOW\_PKT & _MAX\_IP\_PKT\_LEN_ & 1.0 \\ \hline ICMP\_TYPE & _ICMP\_IPV4\_TYPE_ & 0.9999 \\ \hline CLIENT\_TCP\_FLAGS & _TCP\_FLAGS & 0.9962 \\ \hline NUM\_PKTS\_1024\_TO\_1514\_BYTES & _OUT\_BYTES_ & 0.9894 \\ \hline RETRANSMITTED\_OUT\_PKTS & _RETRANSMITTED\_OUT\_BYTES_ & 0.9893 \\ \hline OUT\_PKTS & _OUT\_BYTES_ & 0.8949 \\ \hline NUM\_PKTS\_1024\_TO\_1514\_BYTES & _OUT\_PKTS_ & 0.8863 \\ \hline RETRANSMITTED\_IN\_PKTS & _RETRANSMITTED\_IN\_BYTES_ & 0.8567 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: List of feature pairs with the strongest correlation \(>\) 0.8.