Research Article

Network Traffic Classification Based on SD Sampling and Hierarchical Ensemble Learning

Table 5

The feature set of CICIDS2017.

CategoryFeature nameCount

Flow labelDestination port, protocol, flow duration3
IATFlow IAT mean, flow IAT std, flow IAT max, flow IAT min, fwd IAT total, fwd IAT mean, fwd IAT std, fwd IAT max, fwd IAT min, bwd IAT total, bwd IAT mean, bwd IAT std, bwd IAT max, bwd IAT min14
Forward/backward traffic packetsTotal fwd packets, total backward packets, total length of fwd packets, total length of bwd packets, fwd packet length max, fwd packet length min, fwd packet length mean, fwd packet length std, bwd packet length max, bwd packet length min, bwd packet length mean, bwd packet length std, min packet length, max packet length, packet length mean, packet length std, fwd header length, bwd header length, packet length variance, average packet size, avg fwd segment size, avg bwd segment size, fwd header length, subflow fwd packets, subflow fwd bytes, subflow bwd packets, subflow bwd bytes, Init_Win_bytes_forward, Init_Win_bytes_backward, act_data_pkt_fwd, min_seg_size_forward31
FlagsFwd PSH flags, bwd PSH flags, fwd URG flags, bwd URG flags, FIN flag count, SYN flag count, RST flag count, PSH flag count, ACK flag count, URG flag count, CWE flag count, ECE flag count12
Flow rateFlow bytes/s, flow packets/s, fwd packets/s, bwd packets/s, fwd avg bytes/bulk, fwd avg packets/bulk, fwd avg bulk rate, bwd avg bytes/bulk, bwd avg packets/bulk, bwd avg bulk rate10
OtherDown/up ratio, active mean, active std, active max, active min, idle mean, idle std, idle max, idle min9