  Cyber-attacks continue to grow, both in terms of volume and sophistication.
This is aided by an increase in available computational power, expanding attack
surfaces, and advancements in the human understanding of how to make attacks
undetectable. Unsurprisingly, machine learning is utilised to defend against
these attacks. In many applications, the choice of features is more important
than the choice of model. A range of studies have, with varying degrees of
success, attempted to discriminate between benign traffic and well-known
cyber-attacks. The features used in these studies are broadly similar and have
demonstrated their effectiveness in situations where cyber-attacks do not
imitate benign behaviour. To overcome this barrier, in this manuscript, we
introduce new features based on a higher level of abstraction of network
traffic. Specifically, we perform flow aggregation by grouping flows with
similarities. This additional level of feature abstraction benefits from
cumulative information, thus qualifying the models to classify cyber-attacks
that mimic benign traffic. The performance of the new features is evaluated
using the benchmark CICIDS2017 dataset, and the results demonstrate their
validity and effectiveness. This novel proposal will improve the detection
accuracy of cyber-attacks and also build towards a new direction of feature
extraction for complex ones.
