25
In the NSL-KDD, these four classes (as well as normal traffic) are not equally distributed in the
dataset. We can see from the initial analysis that the most common class of attacks is the DoS,
both in the training (Figure
7):
Figure 6: distribution of traffic by class of attack in training dataset
Figure 7: distribution of traffic by class of attack in test dataset