# Models versus Datasets: Reducing Bias through Building a Comprehensive IDS Benchmark
## 4 Experiments, Results, and Analysis
### Top Contributing Features
For an IDS, eliminating unnecessary features can help in improving the performance, reducing the computational cost, and early detection of malicious traffic. In addition to these benefits, feature optimization also helps to find a subset of features that can produce better classification results. \begin{table}
\begin{tabular}{l l} \hline \hline
**Dataset** & **Feature Name** \\ \hline BoT\_IoT & sport, TnBPsrcIP, dport, drate, pkts \\ \hline CICIDS2017 & Packet Length Variance, Down/Up Ratio, Fwd IAT Max, Packet Length Std, Flow IAT Std, Avg Bow Segment Size, Bowd IAT Total, Bowd Packet Length Max, Bwd Packet Length Mean, Bwd Packet Length Min, Bwd Packet Length Std, FIN Flag Count, Flow Duration, Flow IAT Max, Flow Packets/s, Fwd IAT Total, Fwd Packet Length Mean, Fwd Packet Length Min, Fwd Packet Length Std, Idle Max, Idle Mean, Idle Min, Max Packet Length, Packet Length Mean \\ \hline NSL-KDD (*a) & \begin{tabular}{l} _s_error\_rate, srv\_serror\_rate, diff\_srv\_rate, fla\_REJ, flag\_SF, protocol\_type\_tcp, protocol\_type\_udp, service\_telnet, srv\_count \\ \end{tabular} \\ \hline NSL-KDD (*b) & \begin{tabular}{l} dst\_host\_srv\_error\_rate, fla\_REJ, flag\_S0, hot, protocol\_type\_icmp, protocol\_type\_icmp, protocol\_type\_udp, service\_domain\_u, service\_cer\_i, service\_private, srv\_count, srv\_diff\_host\_rate, srv\_error\_rate \\ \end{tabular} \\ \hline UNSW\_NB15 & \begin{tabular}{l} ackdat, ct\_dst\_ltm, ct\_dst\_sport\_ltm, ct\_flw\_http\_mthd, djtit, dload, dur, dwin, \\ proto\_udp, proto\_unas, rate, service\_http\_sjit, sload, state\_CON, state\_FIN, state\_INT, swin, trans\_depth \\ \end{tabular} \\ \hline UNSW\_NB15 & \begin{tabular}{l} ackdat, ct\_dst\_ltm, ct\_src\_ltm, djtit, dload, dctp, dwin, \\ proto\_leaf-2, \\ proto\_unas, sjit, sload, sloss, spkts, state\_CON, state\_FIN, state\_INT, stcpb, \\ \end{tabular} \\ \hline N-BaIoT & \
\begin{tabular}{l} H\_L0.01\_mean, H\_L0.1\_mean, H\_L1\_mean, H\_L3\_variance, H\_L3\_weight, H\_L5\_weight, HH\_jit\_L0\_01\_mean, HH\_jit\_L0.01\_weight, HH\_jit\_L0.1\_mean, HH\_jit\_L0.1\_weight, HH\_jit\_lt\_L1\_mean, HH\_jit\_L1\_weight, HH\_jit\_l3\_mean, HH\_jit\_l5\_mean, HH\_L0.1\_mean, HH\_L0.1\_weight, HH\_L0.1\_mean, HH\_L0.1\_weight, HH\_L1\_mean, HH\_L0.1\_weight, HH\_L1\_mean, HH\_L0.1\_weight, HH\_L1\_mean, HH\_L1\_weight, HH\_L3\_mean, HH\_L5\_magnitude, HH\_L5\_mean, HH\_L5\_weight, HPHP\_L0.01\_mean, HPHP\_L0.1\_magnitude, HPHP\_L0.1\_mean, HPHP\_L1\_mean, HPHP\_L1\_magnitude, HPHP\_L1\_mean, HPHP\_L1\_magnitude, HPHP\_L1\_mean, MH\_jit\_l1\_mean, MH\_jit\_l3\_weight, MH\_jit\_l5\_variance, MH\_jit\_l5\_weight \\ \end{tabular} \\ \hline KDD CUP 99 &
\begin{tabular}{l} srv\_serror\_rate, dst\_host\_error\_rate, flag\_SF, diff\_srv\_rate, service\_domain\_u, \\ service\_other, service\_s\_smpt, flag\_S0, hot, service\_ftp\_data, dst\_bytes, dst\_host\_srv\_diff\_host\_rate, duration, flag\_REJ, error\_rate, service\_private \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Top features identified by five or fewer classifiers. \begin{table}
\begin{tabular}{l l} \hline \hline
**Dataset** & **Feature Name** \\ \hline N-BaIoT & \
\begin{tabular}{l} MI\_dir\_L1\_variance, H\_L0.01\_weight, H\_L0.1\_variance, H\_L1\_weight, H\_L0.1\_weight, H\_L0.01\_variance, H\_L1\_variance, MI\_dir\_L0.1\_variance, MI\_dir\_L0.1\_weight \\ \end{tabular} \\ \hline KDD CUP 99 &
\begin{tabular}{l} dst\_host\_diff\_srv\_rate, dst\_host\_same\_srv\_rate, protocol\_type\_udp, service\_rate, dst\_host\_srv\_serror\_ra, protocol\_type\_tcp, srv\_count \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 5: \(Cont.\)This paper, based on the output of multiple deep learning algorithms and datasets, presented a minimum set of top contributing features consisting of diverse attack classes and algorithms. From the top contributing features shown in Tables 4-6, multiple traffic flow-based features are discovered by each algorithm, for example, source and destination IP addresses, ports, protocol, and flags used.