Improving the Accuracy of Network Intrusion Detection with Causal Machine Learning

Table 3

Description of features in the NSL-KDD dataset.

Feature name	Description
Protocol type	Type of protocol (TCP, UDP...)
Source bytes	No. of B from source to destination
Wrong fragments	No. of wrong fragments
Urgent	No. of urgent packets
Error rate	% of connections with SYN errors
Failed logins	No. of unsuccessful attempts at login
Logged in	If logged in, 1/if login failed, 0
Same srv rate	% of connections to the same service
Count	No. of connections to the same host as the current connection at a given interval
Dst host srv rate	% of connections to different hosts on the same system
# Root	No. of root accesses
# Shells	No. of active command interpreters
Dst host srv serror rate	% of connections to a host and specified service with an S0 error