Network Traffic Anomaly Detection Model Based on Feature Reduction and Bidirectional LSTM Neural Network Optimization

Table 8

Feature selection results.

Dataset	Feature	Number
NSL-KDD	protocol_type, flag, count, serror_rate, rerror_rate, same_srv_rate, dst_host_count, dst_host_srv_count, dst_host_same_srv_rate, dst_host_serror_rate, dst_host_srv_serror_rate, dst_host_rerror_rate, dst_host_srv_rerror_rate	13
UNSW-NB15	Proto, dttl, dloss, sinpkt, swin, stcpb, dmean, ct_state_ttl, ct_dst_ltm, ct_src_dport_ltm, is_sm_ips_ports	11
CICIDS-2017	Destination Port, Flow Duration, Fwd Packet Length Max, Fwd Packet Length Min, Fwd Packet Length Mean, Bwd Packet Length Max, Bwd Packet Length Min, Bwd Packet Length Mean, Bwd Packet Length Std, Flow Packetss, Flow IAT Mean, Flow IAT Std, Fwd IAT Mean, Fwd IAT Std, Fwd IAT Max, Bwd Bwd IAT Max, Fwd PSH Flags, Min Packet Length, Packet Length Mean, Packet Length Std, Packet Length Variance, SYN Flag Count, PSH Flag Count, ACK Flag Count, URG Flag Count, Down/Up Ratio, Average Packet Size, Avg Fwd Segment Size, Avg Bwd Segment Size, Init_Win_bytes_backward, Idle Mean, Idle Std, Idle Max, Idle Min	34