Performance of interval-based features for anomaly detection in network traffic

In this study, the authors conducted a series of experiments to examine which interval-based features are suitable for a particular type of attack. The authors also compared detection performance between individual features and a combination of all features. In our experiments, the authors applied well-known learning algorithms, namely multivariate normal distribution, k-nearest neighbor, and support vector machine, to explore detection performance.