## 3 Traffic Features
### NF-UQ-NIDS-v2 Dataset  
As recommended by surveys [38; 39], this research uses the dataset NF-UQ-NIDS-v2, which is composed of four publicly available and widely utilized datasets: UNSW-NB15, BoT-IoT, ToN-IoT, and CIC-CSE-IDS2018 [15].The first three datasets were prepared by the Cyber Range Lab of the University of New South Wales (UNSW) Canberra, and the fourth one by a common project of the Communications Security Establishment and Canadian Institute for Cybersecurity. UNSW-NB15 has benign traffic as well as nine families of attacks: Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, and Worms [41]. The traffic was captured using the tcpdump tool, whereas the attacks themselves were generated by the IXIA tool. The network in which the dataset was prepared contains virtual servers, client machines, and a firewall. This dataset size is 0.55 GB [36]. BoT-IoT focuses mainly on the cyber threat of botnets. The dataset's PCAP files with the traffic occupy 69.3 GB [15]. Apart from benign traffic, four attacks can be found: DoS, DDoS, Reconnaissance, and Theft. While creating this dataset, the core notion was to highlight the importance of security in IoT networks [42]. The dataset consists of traffic captured by the Node-Red tool between selected IoT sensors. Authors worked, among others, with a smart fridge or a smart thermostat. ToN-IoT is about the computer traffic of IoT networks with operating systems' logs and telemetry data [15]. The creators of this dataset were also guided by the idea of improving the security within IoT networks. They captured benign traffic and nine attacks: Scanning, DoS, DDoS, Ransomware, Backdoor, Injection Attack, XSS, Password Cracking Attack, and Man In The Middle [43]. These attacks were conducted on IoT sensors, like the IoT Global Positioning System tracker, or a remotely activated garage door. The last dataset, CIC-CSE-IDS2018, contains benign traffic and six types of attacks: Brute Force, Heartbleed, Botnet, DoS, DDoS, Exploiting vulnerable software (e.g., backdoors), and web attacks such as SQL injection, Cross-Site Scripting, or Brute Force over HTTP [44]. The architecture of the used network was immensely expanded, as it contained three servers, ten computers (Windows, Linux and Mac) and a firewall. Two datasets, CIC-CSE-IDS2018 and UNSW-NB15, are characterized by a high percentage of benign traffic samples included. The percentage of attack samples is relatively small (less than 20% to 80% of normal traffic). Radically different are the two remaining datasets, where normal traffic represents just a few percentages of all samples [15]. The original versions of the four datasets contain only a few common features, e.g., IPv4 addresses. Noticeably, more features, like the outgoing number of bytes, are less popular and occur only in some datasets. A list of features present in particular original datasets is shown in Table 2. When unifying datasets, the authors of [15] decided to regenerate network traffic features from original raw traffic (PCAP files) with the advantage of the nProbe tool. As a result, a new set with a total number of 75,987,976 records was generated. The NF-UQ-NIDS-v2 dataset not only merges the mentioned four datasets but also provides an extended and unified set of network traffic features when compared to their standard versions. Conducting experiments on the whole NF-UQ-NIDS-v2 demands relatively high computational power. Therefore, some research teams decided to work only on portions of the dataset. In [45], intrusion detection with seven machine learning algorithms was tested on two subsets of NF-UQ-NIDS-v2: 100,000 and 10 mln records. In different research devoted to securing the telecommunication industry [46], deep learning methods were tested on 100,000 dataset records. Two subsets of NF-UQ-NIDS-v2, i.e., NF-BoT-IoT-v2 and NF-CSE-CIC-IDS2018-v2, constituted the data on which the detection of DDoS attacks on IoT was checked [47]. Another study explored the idea of using representational learning