# NTARC: A Data Model for the Systematic Review of Network Traffic Analysis Research
## 7 Analysis of NTA Research (NTARC Database)
### Features  
[PERSON] et al. [72] emphasized feature selection as one of the main challenges of machine learning-based pattern recognition and classification in NTA. Literally, the authors remarked: \"(i) key feature selection, (ii) finding the best algorithm(s) for traffic classification, and (iii) obtaining representative data sets for training and testing machine learning algorithms\".  
The selection of network features that are relevant for NTA is an open question that has been addressed several times from analytic perspectives. Since there is no global agreement in this regard, feature selection is an expected step and part of best practices recommendations (mainly for supervised analysis). Thirty-five percent of the studied works conducted some type of feature selection. In parallel, [PERSON] et al. also emphasized the importance of studying the discriminative power of features [72].  
An example of a study focused on features is [127], where stability selection and diverse filters and wrappers were applied for feature selection, concluding a set of the 16 most relevant features. This set is hardly generalizable since it is inevitably linked to the NSL-KDD dataset. This dataset and other datasets belonging to the popular DARPA-KDD family are published pre-processed and account for an original set of 41 features. As mentioned in Section 7.3, normal traffic and attack vectors in these datasets were captured and generated before the year 2000. The facts that network communications, applications, and protocols are so variable and evolve so quickly make it difficult for analytical approaches to be representative, and they soon become outdated. Furthermore, the possibilities for extracting features from network data are immense. Nevertheless, the study showed how researchers highly disagree about the relevance of features even when targeting the same questions with the same datasets and the same initial set of 41 features.  
A meta-analysis with an early version of NTRC (NTARC.v1) was used to explore the problem of feature selection in NTA in [34]. This work explored what the scientific community recommends by achieving a consensus based oil the main, most cited works published from 2002 to 2017. Results showed a set of 12 features that clearly stood out. These features are:  
Figure 5: NTA datasets and types of analysis (algorithm families). The algorithms shown include the authors’ main proposals, as well as other approaches used as benchmarks.  
(1) octetTotalCount, (2) ipTotalLength, (3) destinationTransportPort, (4) sourceTransportPort, (5) flowDurationMilliseconds, (6) packetTotalCount, (7) destinationIPv4 Address, (8) sourceIPv4 Address, (9) protocolIdentifier, (10) server_to_client, (11) client_to_server, (12) interPacketTime.  
The meaning of the features can be consulted in the IANA-IPFIX documentation [128], except for Features (10) and (11), which simply mark flow direction. This feature set was used in a comparative study of lightweight NTA feature vectors [129], achieving the best commitment between accuracy and processing costs together with the feature set introduced in [54], which consisted of 30 features. Even in spite of the fact that the 12 feature set obtained in [34] might be insufficient for complete, high-accuracy detectors, it might be taken as a benchmark or a coarse-granularity phase for NTA frameworks.