## 6 Conclusions  
The research described in this paper focused on finding the minimal set of internet traffic features that preserve the high detection accuracy of harmful internet traffic. Such a feature set allows obtaining a fast decision-tree-based classifier for real-time network intrusion detection systems. A novel procedure was proposed and applied to rank available features from the NF-UQ-NIDS-v2 dataset to obtain such a set according to their importance for traffic sample classification. In the study described in the paper, the feature selection procedure is based on six classifiers, three that are decision tree based, and three that are linear and optimized, used twofold--first as an actual classifier and second as a tool for feature ordering--resulting in their ranking. Rankings generated by all classifiers are combined in a weighted manner using classifiers' accuracy as ranks to obtain the final ranking. The second part of this research was focused on investigating the influence of the number of features used to build the classifier on its performance. This is considered both computational efficiency (inference speed) and efficiency in terms of accuracy, precision and recall. As a baseline classifier, the decision tree was chosen. This choice was motivated by its high inference speed--the decision tree is one of the fastest classifiers, being an obvious choice in real-time machine learning-based intrusion detection systems. For comparative purposes, the same analysis was performed on the slower random forest classifier. The random forest outperformed the decision tree when using up to seven features, while when exceeding this number, the simple decision tree performed better, exceeding the level of 95% accuracy. Moreover, the decision-tree classifier built using 8 features, chosen using the proposed procedure, performed 2.5\(\times\) faster than the one induced using 30 features with only 1.9 p.p. lower accuracy. The obtained results are not higher than those performed on the same dataset and reported in other studies (see Table 6), but it is worth noting that in this study, just a simple classifier, a decision tree, was intentionally selected. The undoubted benefit of this choice is the tree's speed of sample processing, which is faster than that of comparable studies (see Table 8). The goal of this paper was, however, not only to find an optimal set of features for a particular dataset but also to outline a general approach to processing network traffic data. The proposed framework consists of the creation of a ranking of the features based on ensemble learning followed by weighted feature aggregation. It may be applied to other datasets and based on different classifiers. Moreover, we claim that the results of the feature selection process are more useful when they are expressed not in the form of a single result (a particular number of features for a given classifier) but rather in the form of relations between the number of features and classifier performance in the two above-mentioned aspects. The dependence of the quality metrics and inference speed from the number of features allows one to build a classifier, fulfilling particular requirements. For instance, given a required sample processing speed for a particular network device and transmission standard, one may find the optimal number of features that are used in a decision-tree classifier to guarantee obtaining this speed.