Towards a Standard Feature Set for Network Intrusion Detection System Datasets

Abstract

Network Intrusion Detection Systems (NIDSs) are important tools for the protection of computer networks against increasingly frequent and sophisticated cyber attacks. Recently, a lot of research effort has been dedicated to the development of Machine Learning (ML) based NIDSs. As in any ML-based application, the availability of high-quality datasets is critical for the training and evaluation of ML-based NIDS. One of the key problems with the currently available datasets is the lack of a standard feature set. The use of a unique and proprietary set of features for each of the publicly available datasets makes it virtually impossible to compare the performance of ML-based traffic classifiers on different datasets, and hence to evaluate the ability of these systems to generalise across different network scenarios. To address that limitation, this paper proposes and evaluates standard NIDS feature sets based on the NetFlow network meta-data collection protocol and system. We evaluate and compare two NetFlow-based feature set variants, a version with 12 features, and another one with 43 features.

13 pages, 4 figures, 13 tables. arXiv admin note: substantial text overlap with arXiv:2011.09144

References in corpus (2)

• A Survey of Network-based Intrusion Detection Data Sets
• NetFlow Datasets for Machine Learning-based Network Intrusion Detection Systems

Cited by in corpus (4)

• Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks
• Evaluating Standard Feature Sets Towards Increased Generalisability and Explainability of ML-based Network Intrusion Detection
• On Generalisability of Machine Learning-based Network Intrusion Detection Systems
• Improving the Reliability of Network Intrusion Detection Systems through Dataset Integration