## 2 Materials and Methods
### Network Scenarios
#### 2.2.2 Wired Scenario  
The wired network has a structure with 20 hosts connected, including serial port connections with standard output devices. User's access is limited to web services such as corporate e-mail, database access and secure websites. The most frequent identified services were connected through ports: 80, 443, 13,000, 445, 16,881 and 2,011. The wired network architecture is shown in Figure 4. There were 35,047 connections. Datasets were collected in 17 buffers, and there were 27,465 closed connections with 3,534,549 packets.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Feature** & **Description** \\ \hline Unusual TCP flags & Boolean variable to check the connection when \\  & it has received packets with an unusual TCP flag configuration. \\ \hline Number of out of & Number of packets that arrive with delay and \\ sequence packets & change the message’s order (latency). \\ \hline Average of the & This is the average size of the real message without the header. Payload size is \\ payload size in bytes & shown in an integer variable represented in bytes series. The result sizes \\  & shown depend on services requested and connections active. \\ \hline Count of the connections & This feature has control of the connections from \\ from this client in the & the specific host-client only in the last capture or data analysis. \\ last connection & This feature is an integer variable. \\ \hline Percentage of connections & The S0 state is a configuration to check an initial Synchronization (SYN), but \\ from the current client with & after, there are no reports of a server request. The S1 state is the configuration of \\  & the three-way \\ the States S0 and S1 & hand-shake connection, but does not show more packets between the \\  & network traffic. \\ \hline Percentage of connections & This is a feature shown in a double variable, because it represents a percentage \\ from the current client & of the connections from the current client that has the same host and \\ to the current host & request services. \\ \hline Percentage of connections & The percentage of connections that has attempted connecting \\ to the current host with & with the server, but has not received answer. Then, the same sends another \\ State S0 and others & package with a new attempt to receive an answer. \\ \hline Difference between the & \\ number of connections to & Represents the connections rejected from the host. The host rejected \\ the current host & difference is compared with the ACK package request that has this host. \\ \hline Difference between the & Represents the connections rejected, but depends on the service \\ number of connections to & requested. The service rejected difference is compared for the \\ the current service & current service approved against requested services. \\ \hline Unanswered host count & This feature is shown in an integer variable based on the number of \\  & connections unanswered by the host. It is based on the number of \\  & packages that have not arrived to the destination. \\ \hline \hline \end{tabular}
\end{table}
Table 1: Behavior change detector features description.