# DNS over HTTPS Tunneling Detection System Based on Selected Features via Ant Colony Optimization
## 3 The Proposed Work
### Dataset Description
\begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **Feature Name** & **Description** & **Feature Name** & **Description** \\ \hline
1 & Duration & The total duration of the traffic flow from the first packet to the last. & PacketTimeMean & The average time between successive packets in the flow. \\ \hline
2 & FlowBytesSent & Quantity of bytes transmitted by the source in the flow. & PacketTimeMedian & Median & Median packet time interval, showing the middle of the timing data. \\ \hline
3 & FlowSentRate & The rate in bytes per second at which data was sent by source. & PacketTimeMode & Which is the time interval between packets that occur most frequently. \\ \hline
4 & FlowBytesReceived & Total amount of bytes received by the destination in the traffic flow. & PacketTimeSkewFromMedian & Skew of packet timing with respect to the median, which will give any timing asymmetry. \\ \hline
5 & FlowReceivedRate & Receipt Rates. The rate at which data was coming into the destination, measured in bytes per second. & PacketTimeSkewFromMode & Skewness in packet times concerning the mode, and it will give the measure of asymmetry in frequent timings. \\ \hline
6 & PacketLengthVariance & The packet length time series is representative of variability or dispersion. & PacketTimeCoefficientofVariation & It defines the variability in packet time relative to the mean, standardized by the mean. \\ \hline
7 & PacketLengthStandardDeviation & Standard deviation in packet length is essentially the measure of the magnitude of the stress taken by packets. & ResponseTimeVariance & The variance in the response time from the destination server. \\ \hline
8 & PacketLengthMean & The average length of the packets in the flow. & ResponseTimeStandardDeviation & The standard deviation of response times is a measure of the dispersion of the respective response times. \\ \hline
9 & PacketLengthMedian & The median value of the packet lengths showing the midpoint in the dataset. & ResponseTimeMean & Average response time of the destination server. \\ \hline
10 & PacketLengthMode & The most frequent packet length within the flow. & ResponseTimeMedian & Median time of response from the server. \\ \hline
11 & PacketLengthSkewFromMedian & Skewness of Packet lengths from the Median The asymmetry. & ResponseTimeMode & The most frequent response time from the server. \\ \hline
12 & PacketLengthSkewFromMode & Skew of packet lengths from mode; higher is more asymmetric. & ResponseTimeSkewFromMedian & Skewness of response times relative to the median, which gives a measure of asymmetry in server responses. \\ \hline
13 & PacketLengthCoefficientofVariation & Variability Ratio: This is the standard deviation of packet lengths to the mean. Higher values are expected to indicate variability around the mean. & ResponseTimeSkewFromMode & Skewness of response times, relative to the mode, results from a deviation with respect to the most common response time. \\ \hline
14 & PacketTimeVariance & Packet intervals dispersion: Variance in timing between packets. & ResponseTimeCoefficientofVariation & The ratio of the standard deviation to the mean of response times, which shows relative variability \\ \hline
15 & PacketTimeStandardDeviation & The standard deviation of the packet interarrival times. & & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Description of dataset features.