## 2 Previous Works
### Network Traffic Datasets  
Detailed revision of the available datasets for network intrusion detection with special attention to the technical aspects of the data was presented in [35]. The research contained the following criteria for dataset properties: evaluation, recording environment, nature of the data, data volume, and general information. In the first group, there was meaningful information, like labeling or the dataset being balanced, which was contained in the evaluation. The recording environment group informed us if the traffic was emulated, e.g., inside a university network, or captured in a real-world scenario, e.g., honeypot. The nature of the data was about the data format, the existence of metadata, and anonymity, if any. The paper mainly focused on packet or flow-based traffic. However, some feature-based datasets, like KDD Cup 1999, were also described. The paper concluded that no perfect  
\begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Method** & **Wrapper** & **Embedded** & **Filter** & **Hybrid** \\ \hline SVM Rank [29] & & 1 & 4 & 1 \\ Voting [30] & 2 & 1 & 2 & \\ Majority voting [31] & & & 5 & \\ Average importance factor [32] & & & 2 & \\ [PERSON] Rank [33] & & & 2 & \\ Weighted average [34] & 1 & 2 & & \\ Our approach & 6 & & & \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of ensemble feature selection concepts for cybersecurity purposes.  
network-based dataset exists. However, researchers recommend working with up-to-date, correctly labeled and, ideally, publicly available datasets.  
Datasets tested with the advantage of convolutional neural networks were gathered and ranged according to their popularity [36]. From this research article, datasets in the format of features, e.g., UNSW-NB15 and ISCX-IDS-2017, were, among others, highlighted. Special attention was paid to the datasets' size or year of creation and exact studies in which they were tested.  
The survey about protecting critical infrastructure mentions twenty datasets used for cybersecurity purposes [37]. The feature-based NF-UQ-NIDS-v2 is up to date when compared with the majority of other datasets.  
The usability ranking of datasets is an interesting concept while selecting datasets [38]. The survey continued the idea of [35] and highlighted that some datasets need to be correctly labeled. The authors also focused on the presence of complex attacks and feature sufficiency. In this scientific research, seven popular network traffic datasets were compared, pointing to NF-UQ-NIDS-v2 [15] as the best choice for researchers.  
Similarly, in survey [39] that compared 16 network traffic datasets, the differentiation of attacks was highlighted. The article described the availability and accuracy of labeling as important dataset properties. Here, NF-UQ-NIDS-v2 was also a recommendation for researchers.  
In another review of datasets [40], the authors mainly compared those datasets where there is IoT traffic. Among all, they pointed to NF-UQ-NIDS-v2, which, through a unified set of features, provides the opportunity to compare the classification results of each of its component datasets.  
According to the recommendations, such as a dataset being up to date or containing real-world traffic, the choice of the surveys mentioned earlier relating to the top dataset is found to be constructive. Therefore, in this paper, the NF-UQ-NIDS-v2 dataset is utilized. In addition, it is worth noting that this dataset contains an increased number of network attacks compared to a single dataset [21]. Also of great importance is a unified set of features based on the popular Netflow protocol. The aforementioned benefits make NF-UQ-NIDS-v2 a universal dataset for IDS learning purposes.