# Generating Network Intrusion Detection Dataset Based on Real and Encrypted Synthetic Attack Traffic
## 4 Hikari-2021 Generation Methodology
### Feature Description  
HIKARI-2021 features were extracted using Zeek. Table 3 shows the features while Figure 4 displays a statistical description of the features. Most of the features were adopted from CICIDS-2017, while uid, originh, originp, responh, responp, traffic_category, and Label were derived from Zeek.  
\begin{table}
\begin{tabular}{l l r r} \hline \hline
**Traffic Category** & **Label** & **Total Flows (Flowmeter)** & **No. Encrypted Session** \\ \hline Background & Benign & 170,151 & 36,782 \\ Benign & Benign & 347,431 & 116,309 \\ Bruteforce & Attack & 5884 & 5884 \\ Bruteforce-XML & Attack & 5145 & 5145 \\ Probing & Attack & 23,388 & 23,388 \\ XMRIGCC CryptoMiner & Attack & 3279 & 0 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Labeled features information.  
Figure 3: The preprocessing flow of HIKARI-2021 dataset.  
\begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**No** & **Feature** & **No** & **Feature** & **No** & **Feature** \\ \hline
1 & uid & 30 & flow\_ECE\_flag\_count & 59 & flow\_iat.avg \\
2 & originh & 31 & fwd\_pkts\_payload\_min & 60 & flow\_iat.std \\
3 & originp & 32 & fwd\_pkts\_payload\_max & 61 & payload\_bytes\_per\_second \\
4 & responh & 33 & fwd\_pkts\_payload\_tot & 62 & fwd\_subflow\_pkts \\
5 & responp & 34 & fwd\_pkts\_payload\_avg & 63 & bwd\_subflow\_pkts \\
6 & flow\_duration & 35 & fwd\_pkts\_payload\_std & 64 & fwd\_subflow\_bytes \\
7 & fwd\_pkts\_tot & 36 & bwd\_pkts\_payload\_min & 65 & bwd\_subflow\_bytes \\
8 & bwd\_pkts\_tot & 37 & bwd\_pkts\_payload\_max & 66 & fwd\_bulk\_bytes \\
9 & fwd\_data\_pkts\_tot & 38 & bwd\_pkts\_payload\_tot & 67 & bwd\_bulk\_bytes \\
10 & bwd\_data\_pkts\_tot & 39 & bwd\_pkts\_payload\_avg & 68 & fwd\_bulk\_packets \\
11 & fwd\_pkts\_per\_sec & 40 & bwd\_pkts\_payload\_std & 69 & bwd\_bulk\_packets \\
12 & bwd\_pkts\_per\_sec & 41 & flow\_pkts\_payload\_min & 70 & fwd\_bulk\_rate \\
13 & flow\_pkts\_per\_sec & 42 & flow\_pkts\_payload\_max & 71 & bwd\_bulk\_rate \\
14 & down\_up\_ratio & 43 & flow\_pkts\_payload\_tot & 72 & active\_min \\
15 & fwd\_header\_size\_tot & 44 & flow\_pkts\_payload\_avg & 73 & active\_max \\
16 & fwd\_header\_size\_min & 45 & flow\_pkts\_payload\_std & 74 & active\_tot \\
17 & fwd\_header\_size\_max & 46 & fwd\_iat\_min & 75 & active\_avg \\
18 & bwd\_header\_size\_tot & 47 & fwd\_iat\_max & 76 & active\_std \\
19 & bwd\_header\_size\_min & 48 & fwd\_iat\_tot & 77 & idle\_min \\
20 & bwd\_header\_size\_max & 49 & fwd\_iat\_avg & 78 & idle\_max \\
21 & flow\_FIN\_flag\_count & 50 & fwd\_iat\_std & 79 & idle\_tot \\
22 & flow\_SYN\_flag\_count & 51 & bwd\_iat\_min & 80 & idle\_avg \\
23 & flow\_RST\_flag\_count & 52 & bwd\_iat\_max & 81 & idle\_std \\
24 & fwd\_PSH\_flag\_count & 53 & bwd\_iat\_tot & 82 & fwd\_init\_window\_size \\
25 & bwd\_PSH\_flag\_count & 54 & bwd\_iat\_avg & 83 & bwd\_init\_window\_size \\
26 & flow\_ACK\_flag\_count & 55 & bwd\_iat\_std & 84 & fwd\_last\_window\_size \\
27 & fwd\_UR\_flag\_count & 56 & flow\_iat\_min & 85 & traffic\_category \\
28 & bwd\_URG\_flag\_count & 57 & flow\_iat\_max & 86 & Label \\
29 & flow\_CWR\_flag\_count & 58 & flow\_iat\_tot & & \\ \hline \hline \end{tabular}
\end{table}
Table 3: List of features in HIKARI-2021.  
Figure 4: Most of the features are skewed, where the value of the 95 th percentile is less than ten percent of the maximum value.