# Adversarial Robust and Explainable Network Intrusion Detection Systems Based on Deep Learning
## 3 Experiments and Results
### IDS Datasets Selection
\begin{table}
\begin{tabular}{c c c c} \hline
**Feature Number** & **Feature** & **Type** & **Description** \\ \hline
1 & Duration & Numeric & Duration of the connection \\
2 & Protocol\_type & Nominal & Type of the protocol \\
3 & Service & Nominal & Network service on the destination \\
4 & Flag & Nominal & Normal or error status of the connection \\
5 & Src\_bytes & Numeric & Number of bytes transferred from source to destination \\
6 & Dst\_bytes & Numeric & number of bytes transferred from destination to source \\
7 & Land & Binary & 1 if the connection is from/to the same host/port; 0 otherwise \\
8 & Wrong\_fragment & Numeric & number of “wrong” fragments \\
9 & Urgent & Numeric & number of urgent packets (with the urgent bit set) \\
10 & Hot & Numeric & number of “hot” indicators \\
11 & Num\_failed\_logins & Numeric & number of failed login attempts \\
12 & Logged\_in & Binary & 1 if successfully logged in; 0 otherwise \\
13 & Num\_compromised & Numeric & number of “compromised” conditions \\
14 & Root\_shell & Binary & 1 if root shell is obtained; 0 otherwise \\
15 & Su\_attempted & Binary & 1 if “su root” command attempted; 0 otherwise \\
16 & Num\_root & Numeric & number of “root” accesses \\
17 & Num file are atoms & Numeric & number of file creation operations \\
18 & Num\_shells & Binary & number of shell prompts \\
19 & Num\_access\_files & Numeric & number of operations on access control files \\
20 & Num\_outbound\_cmds & Numeric & number of outbound commands in an ftp session \\
21 & Is\_hot\_login & Binary & 1 if the login belongs to the “hot” list: 0 otherwise \\
22 & Is\_guest\_login & Binary & 1 if the login is a “guest” login; 0 otherwise \\
23 & Count & Numeric & number of connections to the same host as the current connection (Note) \\
24 & Serror\_rate & Numeric & number of connections that have “SYN” errors \\
25 & Rerror\_rate & Numeric & \% of connections that have “REJ” errors \\
26 & Same\_sr\_rate & Numeric & \% of connections to the same service \\
27 & Diff\_sr\_rate & Numeric & \% of connections to different services \\
28 & Srv\_count & Numeric & \% of connections to the same service as the current connection in \\
29 & Srv\_error\_rate & Numeric & \% of connections that have “SYN” errors \\
30 & Srv\_error\_rate & Numeric & \% of connections that have “REJ” errors \\
31 & Srv\_diff\_host\_rate & Numeric & \% of connections to different hosts \\
32 & Dst\_host\_count & Numeric & number of connections having the same destination host \\
33 & Dst\_host\_srv\_count & Numeric & number of connections using the same service \\
34 & Dst\_host\_same\_sr\_ & Numeric & \% of connections using the same service \\
35 & Dst\_host\_srv\_diff\_ & Numeric & \% of different services on the current host \\
36 & Dst\_host\_same\_src\_ & Numeric & \% of connections to the current host having the same src port \\
37 & Dst\_host\_srv\_diff\_ & Numeric & \% of connections to the same service coming from different hosts \\
38 & Dst\_host\_server\_rate & Numeric & \% of connections to the current host that have a so error \\
39 & Dst\_host\_srv\_error\_rate & Numeric & \% of connections to the current host and specified service that \\
40 & Dst\_host\_error\_rate & Numeric & \% of connections to the current host that have an RST error \\
41 & Dst\_host\_srv\_error\_rate & Numeric & \% of connections to the current host and specified service that \\ \hline \end{tabular}
\end{table} 
Table 1: Total features in the NSL-KDD dataset. Data from [23,24]. There are four classes in the dataset from 39 different attacks, the test set has a total of 37 attacks, and the train set has a total of 22 attacks, as shown in Tables 2 and 3, respectively: denial of service (DoS), probe, remote to local (R2L and user to Root (U2R)) as presented in Tables 2 and 3.