Table 4.

Features selected by four feature evaluation measures for different attack classes in UNSW-NB15.

Attack class	Correlation		Consistency
	NF	Feature subset	NF	Feature subset
Fuzzers	(1)	{10}	(11)	{3,7,8,9,10,17,27,28,32,33,35}
Analysis	(3)	{2,27,35}	(11)	{2,13,18,27,28,31,34,36,39,40,41}
Backdoor	(2)	{2,35}	(6)	{2,3,7,27,28,40}
DoS	(2)	{2,10}	(7)	{3,7,8,16,31,40,41}
Exploits	(3)	{2,10,32}	(12)	{2,7,8,9,10,17,27,28,31,36,40,41}
Generic	(4)	{3,4,11,35}	(8)	{3,7,8,25,27,31,36,40}
reconnaissance	(2)	{7,10}	(8)	{2,3,7,12,31,36,40,41}
Shellcode	(2)	{10,41}	(8)	{3,7,8,27,31,33,36,40}
Worms	(2)	{7,30}	(5)	{3,7,10,15,27}

Attack class	Information		Distance
	NF	Feature subset	NF	Feature subset
Fuzzers	(11)	{7,10,8,32,11,27,13,9,28,17,1}	(11)	{10,11,16,32,42,28,13,20,2,3,40}
Analysis	(11)	{7,27,12,2,8,9,28,1,13,32,6}	(11)	{2,3,4,10,16,20,21,22,27,29,42}
Backdoor	(11)	{7,2,27,12,8,9,1,28,11,32,10}	(11)	{2,4,10,16,20,27,31,35,36,41,42}
DoS	(11)	{7,27,2,12,8,9,1,28,11,32,10}	(11)	{2,10,11,16,20,27,31,32,36,41,42}
Exploits	(11)	{7,8,10,27,11,28,32,12,9,1,17}	(11)	{2,11,16,27,28,31,32,35,36,41,42}
Generic	(11)	{7,12,35,27,9,1,34,36,32,41,4}	(11)	{3,9,10,16,27,33,34,35,40,41,42}
Reconnaissance	(11)	{7,27,12,8,28,10,9,6,32,13,1}	(11)	{2,4,10,16,20,27,31,34,36,41,42}
Shellcode	(11)	{7,12,27,10,8,28,9,1,32,6,11}	(11)	{2,3,4,10,16,20,27,29,32,35,42}
Worms	(11)	{7,27,28,8,6,15,3,10,25,32,11}	(11)	{2,3,4,10,16,21,22,27,29,32,42}