# Image-Based Malicious Network Traffic Detection Framework: Data-Centric Approach
## 3 Proposed Detection Framework
### NSL-KDD Dataset Description
\begin{table}
\begin{tabular}{c l l} \hline
**No.** & **Feature Name** & **Description** \\ \hline
1 & duration & Duration of the connection \\
2 & protocol\_type & Connection protocol \\
3 & service & Destination service \\
4 & flag & Status of the connection—Normal or Error \\
5 & src bytes & Bytes sent from source to destination \\
6 & dst\_bytes & Bytes sent from destination to source \\
7 & land & The source and destination IP addresses and port numbers are the same \\
8 & wrong\_fragment & Total number of wrong fragments in this connection \\
9 & urgent & Number of urgent packets \\
10 & hot & Number of “hot” indicators \\
11 & num\_failed\_logins & Count of failed login attempts \\
12 & logged\_in & Login Status \\
13 & num\_compromised & Number of “compromised” conditions \\
14 & root\_shell & A value of 1 if root shell is obtained; 0 otherwise \\
15 & su\_attempted & A value of 1 if the ‘su root’ command is attempted or used; 0 otherwise \\
16 & num\_root & Number of “root” accesses or number of operations performed as a root in the connection \\
17 & num\_file\_creations & Number of file creation operations in the connection \\
18 & num\_shells & The number of times the shell command is used \\
19 & num\_access\_files & Number of operations on access control files \\
20 & num\_outbound\_cmds & Number of outbound commands in an ftp session \\
21 & is\_host\_login & 1 if the login belongs to the “hot” list i.e., root or admin; else 0 \\
22 & is\_guest\_login & 1 if the login is a “guest” login; 0 otherwise \\
23 & count & Number of connections to the same destination host \\
24 & sr\_count & Number of connections to the same port number service \\
25 & serror\_rate & \% of connections that have “SYN” errors \\
26 & sr\_server\_rate & \% of connections that have “SYN” errors \\
27 & rerror\_rate & \% of connections that have “REJ” errors \\
28 & sr\_rerror\_rate & \% of connections that have “REJ” errors \\
29 & same\_srv\_rate & \% of connections to the same service \\
30 & diff\_srv\_rate & \% of connections to different services \\
31 & sr\_diff\_host\_rate & \% of connections to different hosts \\
32 & dst\_host\_count & Number of connections having the same destination host IP address \\
33 & dst\_host\_srv\_count & Number of connections having the same port number \\
34 & dst\_host\_same\_srv\_rate & \% of connections having the same destination host and using the same service \\
35 & dst\_host\_diff\_srv\_rate & \% of different services on the current host \\
36 & dst\_host\_same\_src\_port\_rate & \% of connections to the current host having the same src port \\
37 & dst\_host\_srv\_diff\_host\_rate & \% of connections to the same service coming from different hosts \\
38 & dst\_host\_server\_rate & \% of connections to the current host that have an S0 error \\
39 & dst\_host\_srv\_server\_rate & \% of connections to the current host and specified service that have an S0 error \\
40 & dst\_host\_rerror\_rate & \% of connections to the current host that have an RST error \\
41 & dst\_host\_srv\_rerror\_rate & \% of connections to the current host and specified service that have an RST error \\ \hline \end{tabular}
\end{table} 
Table 1: The NSL-KDD dataset feature description. Figure 2 shows the distribution of normal and attack data samples in the NSL-KDD dataset, visualized using t-distributed Stochastic Neighbor Embedding (t-SNE) [71]. t-SNE is a dimensionality-reduction technique that maps high-dimensional feature data into a two-dimensional space while preserving the local structure of data samples, and it is widely used for visualizing and analyzing the distribution of data samples with high-dimensional features. The \(x\) and \(y\) axes of the t-SNE visualization indicate spatial coordinates in the low-dimensional space without any specific meaning. As shown in Figure 2, the number of normal and attack data samples is nearly equal, confirming that the dataset maintains a balanced class distribution after grouping all attack types into a single class.