Research Article

TR-IDS: Anomaly-Based Intrusion Detection through Text-Convolutional Neural Network and Random Forest

Table 1

Statistical features of the network flow.

Feature Description

protocol Protocol of the flow

src_port Source port

dst_port Destination port

f(b)_urg_num Number URG flags in the forward(backward) direction (0 for UDP)

f(b)_ack_num Number ACK flags in the forward(backward) direction (0 for UDP)

f(b)_psh_num Number PSH flags in the forward(backward) direction (0 for UDP)

f(b)_rst_num Number RST flags in the forward(backward) direction (0 for UDP)

f(b)_syn_num Number SYN flags in the forward(backward) direction (0 for UDP)

f(b)_fin_num Number FIN flags in the forward(backward) direction (0 for UDP)

pkts_num Total packets in the flow

bytes_num Total bytes in the flow

f(b)_pkts_num Total packets in the forward(backward) direction

f(b)_bytes_num Total bytes in the forward(backward) direction

f(b)_len_min Minimum length of packet in the forward(backward) direction

f(b)_len_max Maximum length of packet in the forward(backward) direction

f(b)_len_mean Mean length of packet in the forward(backward) direction

f(b)_len_std Standard deviation length of packet in the forward(backward) direction

duration Duration of the flow

pkts_psec Number of packets per second

bytes_psec Number of packets per second

f(b)_pkts_psec Number of forward(backward) packets per second

f(b)_bytes_psec Number of forward(backward) bytes per second

f(b)_intv_min Minimum time interval between two packets sent in the forward(backward) direction

f(b)_intv_max Maximum time interval between two packets sent in the forward(backward) direction

f(b)_intv_mean Mean time interval between two packets sent in the forward(backward) direction

f(b)_intv_std Standard deviation time interval between two packets sent in the forward(backward) direction