S. No | Feature | Description | Data Type | S. No | Feature | Description | Data Type |
1 | Duration | Duration of the connection. | C | 22 | Is guest login | 1 if the login is a “guest” login; 0 otherwise | D |
2 | Protocol type | Connection protocol | D | 23 | Count | Number of connections to the same host as the current connection in the past two seconds | C |
3 | Service | Destination service | D | 24 | Srv count | Number of connections to the same service as the current connection in the past two seconds | C
|
4 | Flag | Status flag of the connection | D | 25 | Serror rate | % of connections that have “SYN” errors | C |
5 | Source bytes | Bytes sent from source to destination | C | 26 | Srv serror rate | % of connections that have “SYN” errors | C |
6 | Destination bytes | Bytes sent from destination to source | C | 27 | Rerror rate | % of connections that have “REJ” errors | C |
7 | Land | 1 if connection is from/to the same host/port; 0 otherwise | D | 28 | Srv rerror rate | % of connections that have “REJ” errors | C |
8 | Wrong fragment | Number of wrong fragments | C | 29 | Same srv rate | % of connections to the same service | C |
9 | Urgent | Number of urgent packets | C | 30 | Diff srv rate | % of connections to different Services | C
|
10 | Hot | Number of “hot” indicators | C | 31 | Srv diff host rate | % of connections to different hosts | C |
11 | Failed Login | Logins number of failed logins | C | 32 | Dst host count
| Count of connections having the same destination host | C
|
12 | Logged in | 1 if successfully logged in; 0 otherwise | D | 33 | Dst host srv count
| Count of connections having the same destination host and using the same service | C
|
13 | Compromised | Number of “compromised” conditions | C | 34 | Dst host same srv rate | % of connections having the same destination host and using the same service | C
|
14 | Root shell | 1 if root shell is obtained; 0 otherwise | C | 35 | Dst host diff srv rate | % of different services on the current host
| C
|
15 | Su attempted | 1 if “su root” command attempted; 0 otherwise | C | 36 | Dst host same src port rate | % of connections to the current host having the same src port | C
|
16 | Root | Number of “root” accesses | C | 37 | Dst host srv diff host rate | % of connections to the same service coming from different hosts | C
|
17 | File creations | Number of file creation operations | C | 38 | Dst host serror rate | % of connections to the current host that have an S0 error | C
|
18 | Shells | Number of shell prompts | C | 39 | Dst host srv serror rate | % of connections to the current host and specified service that have an S0 error | C
|
19 | Access files | Number of operations on access control files | C | 40 | Dst host rerror rate | % of connections to the current host that have an RST error | C
|
20 | Outbound cmds | Number of outbound commands in an ftp session | C | 41 | Dst host srv rerror rate | % of connections to the current host and specified service that have an RST error | C
|
21 | Is hot login | 1 if the login belongs to the “hot” list; 0 otherwise | D |
|
|
|
|