Table 6 Top features for detecting R2L, used in the second experiment

1

srv_count

0.399

2

count

0.326

3

dst_host_srv_count

0.307

4

service

0.283

5

dst_bytes

0.243

6

src_bytes

0.231

7

hot

0.225

8

is_guest_login

0.215

9

protocol_type

0.208

10

srv_diff_host_rate

0.176

11

dst_host_srv_diff_host_rate

0.175

12

dst_host_same_src_port_rate

0.162

13

num_failed_logins

0.154

14

dst_host_count

0.127

15

flag

0.104