Research Article

MidSiot: A Multistage Intrusion Detection System for Internet of Things

Table 2

Extract network features.

Feature nameDescription

fl_durFlow duration
tot_fw_pkTotal packets in the forward direction
tot_bw_pkTotal packets in the backward direction
tot_l_fw_pktTotal size of the packet in the forward direction
fw_pkt_l_maxMaximum size of the packet in the forward direction
fw_pkt_l_minMinimum size of the packet in the forward direction
fw_pkt_l_avgAverage size of the packet in the forward direction
fw_pkt_l_stdStandard deviation size of the packet in the forward direction
Bw_pkt_l_maxMaximum size of the packet in the backward direction
Bw_pkt_l_minMinimum size of the packet in the backward direction
Bw_pkt_l_avgMean size of the packet in the backward direction
Bw_pkt_l_stdStandard deviation size of the packet in the backward direction
fl_byt_sFlow byte rate that is the number of packets transferred per second
fl_pkt_sFlow packets rate that is the number of packets transferred per second
fl_iat_avgAverage time between two flows
fl_iat_stdStandard deviation time two flows
fl_iat_maxMaximum time between two flows
fl_iat_minMinimum time between two flows
fw_iat_totTotal time between two packets sent in the forward direction
fw_iat_avgMean time between two packets sent in the forward direction
fw_iat_stdStandard deviation time between two packets sent in the forward direction
fw_iat_maxMaximum time between two packets sent in the forward direction
fw_iat_minMinimum time between two packets sent in the forward direction
bw_iat_totTotal time between two packets sent in the backward direction
bw_iat_avgMean time between two packets sent in the backward direction
bw_iat_stdStandard deviation time between two packets sent in the backward direction
bw_iat_maxMaximum time between two packets sent in the backward direction
bw_iat_minMinimum time between two packets sent in the backward direction
fw_psh_flagNumber of times the PSH flag was set in packets travelling in the forward direction (0 for UDP)
bw_psh_flagNumber of times the PSH flag was set in packets travelling in the backward direction (0 for UDP)
fw_urg_flagNumber of times the URG flag was set in packets travelling in the forward direction (0 for UDP)
bw_urg_flagNumber of times the URG flag was set in packets travelling in the backward direction (0 for UDP)
fw_hdr_lenTotal bytes used for headers in the forward direction
bw_hdr_lenTotal bytes used for headers in the forward direction
fw_pkt_sNumber of forward packets per second
bw_pkt_sNumber of backward packets per second
pkt_len_minMinimum length of a flow
pkt_len_maxMaximum length of a flow
pkt_len_avgMean length of a flow
pkt_len_stdStandard deviation length of a flow
pkt_len_vaMinimum interarrival time of the packet
fin_cntNumber of packets with FIN
syn_cntNumber of packets with SYN
rst_cntNumber of packets with RST
pst_cntNumber of packets with PUSH
ack_cntNumber of packets with ACK
urg_cntNumber of packets with URG
cwe_cntNumber of packets with CWE
ece_cntNumber of packets with ECE
down_up_ratioDownload and upload ratio
pkt_size_avgAverage size of packet
fw_seg_avgAverage size observed in the forward direction
bw_seg_avgAverage size observed in the backward direction
fw_byt_blk_avgAverage number of bytes bulk rate in the forward direction
fw_pkt_blk_avgAverage number of packets bulk rate in the forward direction
fw_blk_rate_avgAverage number of bulk rate in the forward direction
bw_byt_blk_avgAverage number of bytes bulk rate in the backward direction
bw_pkt_blk_avgAverage number of packets bulk rate in the backward direction
bw_blk_rate_avgAverage number of bulk rate in the backward direction
subfl_fw_pkThe average number of packets in a subflow in the forward direction
subfl_fw_bytThe average number of bytes in a subflow in the forward direction
subfl_bw_pktThe average number of packets in a subflow in the backward direction
subfl_bw_bytThe average number of bytes in a subflow in the backward direction
fw_win_bytNumber of bytes sent in initial window in the forward direction
bw_win_byt# of bytes sent in initial window in the backward direction
Fw_act_pkt# of packets with at least 1 byte of TCP data payload in the forward direction
fw_seg_minMinimum segment size observed in the forward direction
atv_avgMean time a flow was active before becoming idle
atv_stdStandard deviation time a flow was active before becoming idle
atv_maxMaximum time a flow was active before becoming idle
atv_minMinimum time a flow was active before becoming idle
idl_avgMean time a flow was idle before becoming active
idl_stdStandard deviation time a flow was idle before becoming active
idl_maxMaximum time a flow was idle before becoming active
idl_minMinimum time a flow was idle before becoming active