33
Flags are an important feature of the connection, as they describe whether the connection was
established, terminated, or rejected normally. In the NSL-KDD dataset, there are 11 different
flags that are found in both the training and the test sets. It is shown in the figures below
(Figure 166, Figure 177) that the two subsets have different distributions of the flags:
Figure 16: flags distribution in training set
Figure 17: flags distribution in test set