I am researching on Anomaly Intrusion Detection to implement one. At this phase, I am searching for relevant features to network traffic.
I found 41 features from KDD CUP'99 project (the paper: WENKE LEE, SALVATORE J. STOLFO, "A Framework for Constructing Features and Models for Intrusion Detection Systems") and many papers on how to do feature selection to reduce them and find most relevant ones. I also learned PHAD uses 34 features from the HEADERs.
Are there any other relevant traffic features to let the classification algorithms to detect the anomalies more precisely? I learned about 200 features somewhere but not the details.
EDIT: I found a great survey paper on this, "Jonathan J. Davis, Andrew J. Clark, Data preprocessing for anomaly based network intrusion detection: A review, 2011". Several features are listed as tables in its appendix.