## 3 Traffic Features
### Traffic Features in NF-UQ-NIDS-v2
\begin{table}
\begin{tabular}{l c c} \hline \hline
**Feature** & **Type** & **Description** & **Group** \\ \hline
1. IPV4\_SRC\_ADDR & c & IPv4 source address & II \\
2. L4\_SRC\_PORT & c & IPv4 source port number & II \\
3. IPV4\_DST\_ADDR & c & IPv4 destination address & II \\
4. L4\_DST\_PORT & c & IPv4 destination port number & II \\
5. PROTOCOL & c & IP protocol identifier byte & I \\
6. L7\_PROTO & c & Application protocol as a number & I \\
7. IN\_BYTES & n & Incoming number of bytes & IV \\
8. IN\_RCTS & n & Incoming number of packets & IV \\
9. OUT\_BYTES & n & Outgoing number of bytes & IV \\
10. OUT\_PKTS & n & Outgoing number of packets & IV \\
11. TCP\_FLAGS & c & Cumulative of all TCP flags & III \\
12. CIIENT TCP\_FLAGS & c & Cumulative of all client TCP flags & III \\
13. SERVER\_TCP\_FLAGS & c & Cumulative of all server TCP flags & III \\
14. FLOW\_Duration\_MILISECONDS & n & Flow duration in milliseconds & V \\
15. DURATION\_IN & n & Incoming stream duration in milliseconds & V \\
16. DURATION\_OUT & n & Outgoing stream duration in milliseconds & V \\
17. MIN\_TTL & n & Minimal flow TTL & V \\
18. MAX\_TTL & n & Maximal flow TTL & V \\
19. LONGEST\_FLOW\_PKT & n & Longest packet (bytes) of the flow & IV \\
20. SHORTEST\_FLOW\_PKT & n & Shortest packet (bytes) of the flow & IV \\
21. MIN\_IP\_PKT\_LEN & n & Len of the smallest flow IP packet observed & IV \\
22. MAX\_TP\_PKT\_LEN & n & Len of the largest flow IP packet observed & IV \\
23. SRC\_TO\_DST\_SECOND\_BYTES & n & Src todst bytes/sec & V \\
24. DST\_TO\_SRC\_SECOND\_BYTES & n & Dst to src bytes/sec & V \\
25. RETransMITTED\_IN\_BYTES & n & Number of retransmitted TCP flow bytes (src\_dst) & VI \\
26. RETransMITTED\_UN\_PKTS & n & Number of retransmitted TCP flow packets (src\_dst) & VI \\
27. RETransMITTED\_OUT\_RYTS & n & Number of retransmitted TCP flow packets (dst\_src) & VI \\
28. RETransMITTED\_OUT\_RYTS & n & Src todst average throughput (bps) & V \\
29. SRC\_TO\_DST\_AVG\_THROUGHPUT & n & Dst to src average throughput (bps) & V \\
30. DST\_TO\_SRC\_AVG\_THROUGHPUT & n & Dst to src average throughput (bps) & V \\
31. NUM\_PKTS\_UP\_to\_128\_BYTES & n & Packets whose IP size \(\leq\) 128 & VII \\
32. NUM\_PKTS\_128\_TO\_256\_BYTES & n & Packets whose IP size \(>\) 128 and \(\leq\)256 & VII \\
33. NUM\_PKTS\_256\_TO\_512\_BYTES & n & Packets whose IP size \(>\) 256 and \(<\)512 & VII \\
34. NUM\_PKTS\_512\_TO\_1024\_BYTES & n & Packets whose IP size \(>\) 512 and \(<\)1024 & VII \\
35. NUM\_PKTS\_1024\_TO\_1514\_BYTES & n & Packets whose IP size \(>\) 1024 and \(\leq\)1514 & VII \\
36. TCP\_WIN\_MAX\_IN & n & Max TCP Window (src\_dst\_src) & III \\
37. TCP\_WIN\_MAX\_OUT & n & Max TCP Window (dst\_src) & III \\
38. ICMP\_TYPE & c & ICMP Type 256 + ICMP code & I \\
39. ICMP\_IPV4\_TYPE & c & ICMP Type & I \\
40. DNS\_QUERY\_ID & c & DNS query transaction Id. & I \\
41. DNS\_QUERY\_TYPE & c & DNS query type (e.g., 1 = A, 2 = NS etc.) & I \\
42. DNS\_TT\_ANSWER & n & TTL of the first A record (if any) & I \\
43. FTP\_COMMAND\_RET\_CODE & c & FTP client command return code & I \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Features in NF-UQ-NIDS-v2. Description of each feature follows [15]. independent as possible. Such universally crafted traffic would be perfect for training IDS, which may work in various networks with radically different setups. Unfortunately, this demand for traffic features may be hard to fulfill. Careful analysis of all features led us to divide them into seven groups, collecting features with similar roles and emphasizing the network infrastructure dependence. An assignment of a particular feature to its proper groups is shown in the fourth column of Table 3. The proposed groups of features are as follows:  
1. General information about protocols --group I. This group contains details of protocols utilized in the communication, like the type of L7 protocol, type of ICMP, or FTP command return code.