Network Intrusion Detection Method Based on PCA and Bayes Algorithm

Table 2

Content features of TCP connections.

Features	Descriptions
hot	Number of times to access system sensitive files and directories
num_failed_logins	The number of failed login attempts
logged_in	The successful login is 1, otherwise 0
num_compromised	The number of times the compromised condition appears
root_shell	1 if the root shell was obtained, 0 otherwise
su_attempted	If the “su root” command appears, it is 1, otherwise it is 0
num_root	The number of root user access
num_file_creations	The number of times the file is created
num_shells	The number of times the shell command is used
num_access_files	The number of access control files
num_outbound_cmds	The number of outbound connections in an FTP session
is_hot_login	Whether the login belongs to the “hot” list
is_guest_login	1 if guest login, 0 otherwise