Table 5 Top features for detecting DoS, used in the second experiment

1

srv_serror_rate

0.504

2

serror_rate

0.500

3

flag

0.475

4

dst_host_srv_serror_rate

0.441

5

src_bytes

0.426

6

logged_in

0.417

7

dst_host_serror_rate

0.392

8

diff_srv_rate

0.383

9

dst_bytes

0.334

10

same_srv_rate

0.279

11

service

0.181

12

dst_host_diff_srv_rate

0.173

13

dst_host_same_srv_rate

0.162

14

wrong_fragment

0.161

15

dst_host_srv_diff_host_rate

0.150

16

dst_host_srv_count

0.150

17

count

0.138

18

dst_host_count

0.136

19

srv_diff_host_rate

0.135

20

duration

0.115