A Modified Gray Wolf Optimizer-Based Negative Selection Algorithm for Network Anomaly Detection

Table 3

Selected features and rankings.

Dataset	Feature subset
NSL-KDD	src_bytes, flag, same_srv_rate, diff_srv_rate, service, dst_bytes, dst_host_serror_rate,
	dst_host_srv_serror_rate, dst_host_same_srv_rate, Serror_rate, srv_serror_rate, count,
	dst_host_srv_count, dst_host_diff_srv_rate, logged_in,dst_host_same_src_port_rate,
	dst_host_count, dst_host_count, protocol_type
UNSW-NB15	Smeansz, id, rate, sload, stcpb, dloss, sttl, dload, sjit, sintpkt, sloss, dintpkt, dpkts, dbytes, dbytes,
	swin
CICIDS-2017	sloss, dintpkt, dpkts, dbytes, dbytes, swin, pkt_len_va, fw_seg_avg, bw_win_byt, fin_cnt,
	fw_iat_avg, fw_byt_blk_avg, fl_byt_s, Bw_pkt_l_std, fw_seg_min, subfl_bw_byt, pkt_len_avg,
	fl_iat_min, pkt_len_std, fw_iat_max, bw_pkt_s, Bw_pkt_l_max, bw_iat_std, Fw_act_pkt