# Towards a Standard Feature Set for Network Intrusion Detection System Datasets

**Authors:** Mohanad Sarhan, Siamak Layeghy, Marius Portmann  
**arXiv:** [2101.11315](https://arxiv.org/abs/2101.11315)  
**Date:** 2021-01-27  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2101.11315v2/

## Key points

- Network Intrusion Detection Systems (NIDSs) are crucial for protecting computer networks against cyber attacks
- Machine Learning (ML)-based NIDSs require high-quality datasets for training and evaluation
- Lack of a standard feature set in publicly available datasets makes it challenging to compare the performance of ML-based traffic classifiers on different datasets and evaluate their ability to generalize across various network scenarios
- Researchers proposed and evaluated standard NIDS feature sets based on the NetFlow network meta-data collection protocol and system
- The study compared two NetFlow-based feature set variants: one with 12 features and another with 43 features
- Four widely used NIDS datasets were analyzed: UNSW-NB15, ToN-IoT, BoT-IoT, and CSE-CIC-IDS2018
- Most features were exclusive to individual datasets, making it difficult to evaluate proposed ML models using a targeted feature set across all four datasets
- The ratio of benign-to-attack flows varied significantly in each dataset, with some mainly consisting of attack samples that do not represent realistic network behavior
- Proposed NetFlow-based feature sets can help overcome these challenges by providing a standardized set of features for evaluating ML-based NIDS models across different datasets
- Standardizing feature sets in NIDS datasets can facilitate accurate evaluation and comparison of ML-based traffic classifiers while reducing false positives and negatives.

## Summary

Network Intrusion Detection Systems (NIDSs) are crucial for protecting computer networks against increasingly sophisticated cyber attacks. Machine Learning (ML)-based NIDSs have gained significant attention in recent years, and high-quality datasets are critical for their training and evaluation. However, the lack of a standard feature set in publicly available datasets makes it challenging to compare the performance of ML-based traffic classifiers on different datasets and evaluate their ability to generalize across various network scenarios. To address this limitation, researchers proposed and evaluated standard NIDS feature sets based on the NetFlow network meta-data collection protocol and system. The study compared two NetFlow-based feature set variants: one with 12 features and another with 43 features. The authors also analyzed four widely used NIDS datasets: UNSW-NB15, ToN-IoT, BoT-IoT, and CSE-CIC-IDS2018. The analysis revealed that most features were exclusive to individual datasets, making it difficult to evaluate proposed ML models using a targeted feature set across all four datasets. Additionally, the ratio of benign-to-attack flows varied significantly in each dataset, with some mainly consisting of attack samples that do not represent realistic network behavior. The proposed NetFlow-based feature sets can help overcome these challenges by providing a standardized set of features for evaluating ML-based NIDS models across different datasets. This approach can improve the generalization capability of these systems while reducing false positives and negatives. Overall, this study highlights the importance of standardizing feature sets in NIDS datasets to facilitate accurate evaluation and comparison of ML-based traffic classifiers. It also provides valuable insights into the limitations of current publicly available NIDS datasets and proposes potential solutions for future research in this field.