## 3 Selected Datasets
### Unsw-Nb15  
The UNSW-NB15 dataset is a widely recognized and freely available benchmark for evaluating intrusion detection systems. It was created using the IXIA Perfect Storm tool in the Cyber Range Lab at Canberra University. This dataset combines real-world normal activities with synthetic contemporary attack behaviors to provide a comprehensive testing environment. To generate the dataset, the Tcpdump tool was employed to capture 100 GB of raw traffic data. The dataset includes nine different types of attacks, namely Analysis, Backdoors, DoS, Exploits, Fuzzers, Generic, Reconnaissance, Shellcode, and Worms.  
The Argus and Bro-IDS tools were utilized, resulting in the generation of 47 features through the implementation of twelve algorithms. Tables 3 and 4 present a detailed list of the dataset features, categorized into Flow features, Basic features, Content-based features, Time-based features, General purpose features, and Connection-based features. Each feature is characterized by its type, such as Nominal (N), Integer (I), Float (F), Timestamp (T), or Binary (B). The dataset contains a total of 2,540,047 records, which are stored in four.csv files. Additionally, raw traffic records in.pcap format are also available in the repository. The dataset size corresponds to 2,540,047 observations with 47 features. More information about the dataset can be found in the reference [50].  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Name** & **Type** & **Description** \\ \hline
**Connection-based features** & & \\ \hline Dst-host-scunt & C & Count of dest. hosts \\ Dst-host-srv-count & C & Srv-count for dest. host \\ Dst-host-same-srv-rate & C & Same-srv-rate for dest. host \\ Dst-host-diff-srv-rate & C & Diff-srv-rate for dest. host \\ Dst-host-same-src-port-rate & C & Same-src-port-rate for dest. host \\ Dst-host-srv-diff-host-rate & C & Diff-host-rate for dest. host \\ Dst-host-error-rate & C & Serror-rate for dest. host \\ Dst-host-srv-error-rate & C & Srv-error-rate for dest. host \\ Dst-host-error-rate & C & Rerror-rate for dest. host \\ Dst-host-srv-error-rate & C & Srv-error-rate for dest. host \\ \hline \hline \end{tabular}
\end{table}
Table 2: Cont.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Name** & **Type** & **Description** \\ \hline
**Flow Features** & & \\ \hline srcip & N & Source IP address \\ sport & I & Source port number \\ dstrip & N & Dest. IP address \\ dsport & I & Dest. port number \\ proto & N & Transaction protocol \\ \hline
**Basic Features** & & \\ \hline state & N & State and its dependent protocol \\ dur & F & Record total duration \\ sybte & I & Source to dest. bytes \\ dybtes & I & Dest. to source bytes \\ state & I & Source to dest. time to live \\ dttl & I & Dest. to source time to live \\ sloss & I & Source packets retransmitted or dropped \\ dloss & I & Dest. packets retransmitted or dropped \\ service & N & http, ftp, fgb, shd, dns..., else (-) \\ load & F & Source bits per second \\ load & F & Dest. bits per second \\ spkts & I & Source to dest. packet count \\ dpkts & I & Dest. to source packet count \\ \hline \hline \end{tabular}
\end{table}
Table 3: Features Description UNSW-NB15 part 1.