On Internet Traffic Classification: A Two-Phased Machine Learning Approach

Table 4

NetFlow feature sets for C5.0 classifier training.

Set 1	Set 2
Protocol and port information; (i) Source and destination port num; (ii) Protocol (TCP, UDP)	Protocol and port information; (i) Source and destination port labels; (ii) Protocol (TCP, UDP)
Set 3	Set 4
Flow parameters; (i) Received and transmitted packets (Rx.Pkts., Tx.Pkts.); (ii) Received and transmitted packet rate (Rx.pps., Tx.pps.); (iii) Received and transmitted data rate (Rx.bps., Tx.bps.); (iv) Received and transmitted bytes per packet (Tx.Bpp., Rx.Bpp.); (v) Received and transmitted data (Rx.B., Tx.B.); (vi) Received and transmitted flow duration (Tx.s., Rx.s.)	Flow parameter ratios; (i) Received packets to transmitted packets (Rx.Pkts./Tx.Pkts.); (ii) Received to transmitted packet rate (Rx.pps./Tx.pps.); (iii) Received to transmitted data rate (Rx.bps./Tx.bps.); (iv) Received to transmitted bytes per packet (Rx.Bpp./Tx.Bpp.); (v) Received to transmitted data (Rx.B./Tx.B.); (vi) Received to transmitted flow duration (Rx.s./Tx.s.)