|
| 1 Duration time |
| 2 Protocol type |
| 3 The network service type of the target host |
| 4 The state of a normal or incorrect connection |
| 5 The number of bytes of data from the source host to the target host |
| 6 The number of bytes of data from the target host to the source host |
| 7 If the connection is from/to the same host/port, it is 1; otherwise, it is 0 |
| 8 Number of error segments |
| 9 Number of urgent packets |
| 10 The number of times a system sensitive file or directory has been accessed |
| 11 Number of failed login attempts |
| 12 If successfully login, marked as 1, otherwise, 0 |
| 13 The number of essential capital occurs |
| 14 If the root shell is obtained, it is 1; otherwise, it is 0 |
| 15 The su root command is 1 if it appears, or 0 if it does not |
| 16 Number of root user visits |
| 17 Number of file creation operations |
| 18 The number of times you use shell commands |
| 19 The number of times you access control files, such as access to /etc/passwd or. rhosts files |
| 20 Number of outbound connections in an FTP session |
| 21 The frequency of occurrence of this feature in the dataset is 0 |
| 22 Whether the login belongs to the “hot” list is 1, otherwise 0. |
| 23 The number of connections to the target host as the current connection in the last two seconds. |
| 24 If guest logs in, it is 1; otherwise, it is 0 |
| 25 The number of connections in the last two seconds that have the same service as the current connection |
| 26 The percentage of connections that have “SYN” errors in the last two seconds that have the same target host as the current connection |
| 27 The percentage of connections that have “SYN” errors in the last two seconds that have the same service as the current connection |
| 28 The percentage of connections that have “REJ” errors in the last two seconds that have the same target host as the current connection |
| 29 The percentage of connections that have “SYN” errors in the last two seconds that have the same service as the current connection |
| 30 Over the past two seconds, the percentage of connections that have the same service as the current connection that have the same target host as the current connection |
| 31 Over the past two seconds, the percentage of connections with different services from the current connection that have the same target host as the current connection |
| 32 Over the past two seconds, the percentage of connections that have different target hosts from the current connection that have the same service as the current connection |
| 33 The first 100 connections have the same number of connections to the target host as the current connection |
| 34 Of the first 100 connections, the number of connections that have the same target host and service as the current connection |
| 35 The percentage of the first 100 connections that have the same service on the same target host as the current connection |
| 36 The percentage of the first 100 connections that have different services to the same target host as the current connection |
| 37 The percentage of the first 100 connections that have the same source port with the same target host as the current connection |
| 38 The percentage of the first 100 connections that have the same service as the current connection to the same target host that have a different source host from the current connection |
| 39 The percentage of the first 100 connections that have the same target host as the current connection that have SYN errors |
| 40 The percentage of the first 100 connections with SYN errors that have the same service on the same target host as the current connection |
| 41 The percentage of the first 100 connections that have the same target host as the current connection that have REJ errors |
| 42 The percentage of the first 100 connections that have the same target host and service as the current connection that have REJ errors |
|
