# Analysis of Lightweight Feature Vectors for Attack Detection in Network Traffic
## 1 Introduction  
The omnipresence of network communications--whether we refer to individual persons, societies, companies, or governments--emphasizes the importance of understanding network traffic shapes and properties. The application of network traffic monitoring and analysis are fundamentally intended to enhance security, but also the quality of services and the design of infrastructures and devices. Additionally, scientific research makes the most of network traffic analysis in areas related to telecommunications engineering, data science, and machine learning, among others. From an analytic perspective, network traffic shows some characteristics that strongly challenge analysis frameworks. For instance, network traffic involves: Large datasets, continuous generation of data, high variability and fast evolution of shapes and classes, encrypted information, time-dependency, malicious traffic designed to bypass detection, and the necessity of triggering prompt reactions (mainly for security purposes). Given such a challenging scenario, selecting suitable traffic representations is a relevant and delicate issue. Even with the best analysis algorithms and frameworks, a wrong selection of features will inevitably lead to failure. A second relevant aspect--frequently forgotten in the related research--is that effective attack detection in real environments must be faced by combining multiple techniques in different phases [1]. In keeping with this design idea, first-phase trafficdetectors--the ones addressed here--act as filters that classify and discriminate a major proportion of traffic, therefore allowing more complex algorithms to focus on a small part of the incoming data for an in-depth analysis. Regardless of the desired level of the analysis depth, the possibilities to extract features from network traffic captures are immense. However, extracting large vectors from traffic should be avoided. Working with compact, highly relevant feature sets is recommended, as it leads to better results. This is not a particular rule for network traffic, but a general recommendation in data analysis. As emphasized by [PERSON] and [PERSON] [2], a good feature selection (1) improves analysis performances, (2) speeds up the analysis process, and (3) helps to understand the underlying mechanisms that generated the data. On the other hand, the field of network traffic implies additional limitations to take into account when designing feature vectors; two of the most outstanding are: Data encryption and the overgrowing increase of data generated in networks (i.e., big data) [1]. These two factors have made deep packet inspection infeasible and inefficient. Instead, modern traffic analysis techniques rely on analyzing footprints and profiles obtained from flow-features, which are extracted from packet headers and communication characteristics that do not require checking packet contents [3]. However, as discussed by [PERSON] et al. [4], there are no clear, standard methodologies for analyzing network traffic or general recommendations that suggest a specific set of features, except for cases in which a very well-defined traffic class is aimed. Experts simply follow their intuition and field experience, perhaps resort to previously published works, or acritically apply models and tools with default configurations. In short, the selection of features for attack detection in network security is an open discussion. In this work, we studied five feature sets (we indistinctly use _feature vector_ and _feature set_ throughout the paper) that have been proposed in the scientific literature for the last few years. The selected vectors are equally devised for the fast analysis of traffic in large networks, meaning that they are able to perform traffic classification, discriminate malware from normal traffic, and detect anomalies. Moreover, they are based on flow features and are suitable for encrypted data and big data analysis. We compared and evaluated them in terms of classification performance and computational costs.