## 2 Previous Works
### Selecting Network Traffic Features  
Network traffic can be represented as a set of features, which may reflect important aspects of traffic events, like attacks [15]. In the middle of 1990, the NetFlow protocol was developed by Cisco Systems for accounting purposes. With the timeline, it also became implemented for other tasks, such as billing, application and protocol monitoring, and many others [16]. NetFlow monitors traffic flows through network devices such as a switch or router and generates traffic features suitable for the analysis. Other vendors like Juniper Networks developed their proprietary protocol--similar to NetFlow--jFlow. There are several versions of the NetFlow, jFlow, and other flow-based protocols; therefore, the Internet Engineering Task Force (IETF) developed the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information [17]. Managed network devices like switches and routers can have implemented flow-based exporters that record traffic features and export them to flow collectors. In the case when network traffic has already been recorded as raw traffic and saved in a PCAP file format, those traffic features can be extracted offline with dedicated software. The issues that come with the data are mostly the redundancy and importance of features. Therefore, a wide variety of feature selection methods are proposed. Works devoted to this topic distinguish the following techniques: wrapper, embedded, filter, and hybrid [18; 19]. Wrapper methods are all about submitting different combinations of feature subsets to check their classification results by machine learning algorithms [20]. Then, the subset with the best results defines the ideal batch of features. Wrapper methods are said to be inadequate for massive datasets due to the high demand for computational power. Embedded methods can utilize two ways to determine the best features. Firstly, some methods can adopt machine learning algorithms, e.g., random forest, to classify samples according to each feature. Later, the computed results are compared to find the best set of features. The second group of embedded methods is based on regularization. It means that during computing, penalties are added to features in order to prevent overfitting [21]. In the end, features with a smaller cumulative value of penalties are chosen. Looking for the best features with the advantage of filter methods consists of calculating the coefficient value for each feature to create a ranking [22]. Then, one can decide on the condition on which features with worse coefficient values would be cut off. The last technique for feature selection is hybrid methods. They are any combination of the previously mentioned methods. Selecting the right features for an intrusion detection system (IDS) is crucial for its performance and accuracy. The selection process often involves understanding the nature of network traffic and the types of attacks the IDS is intended to detect. There are several types of features. Basic features [23] include IP addresses, port numbers, protocol types, and packet sizes. They are easy to capture and provide a foundational understanding of the traffic. Content features [24] involve examining the payload of packets for malicious content or anomalies. They can include signatures of known attacks, unusual byte sequences, or suspicious keyword usage. Time-based features [25] focus on the timing of the traffic, like the duration of the connection, the time between packets, or the frequency of connections to a particular IP address. Finally, behavioral features [26] analyze the behavior of hosts or networks over time, such as changes in traffic patterns, unusual outbound connections, or sudden spikes in data transfer. Scientists utilize widely mentioned feature selection methods in their research. For instance, in [10], the authors performed selection using a hybrid method for the classification of traffic features. The work was based on the top 15 features from the UNSW-NB15 dataset.