
		<paper>
			<loc>https://jjcit.org/paper/296</loc>
			<title>ANALYSIS OF PCAP-DERIVED FLOW-BASED TRAFFIC REPRESENTATION FOR LIGHTWEIGHT INTRUSION DETECTION</title>
			<doi>10.5455/jjcit.71-1755027157</doi>
			<authors>Andrés Eduardo Villamarín Olmos,Edward Paul Guillen Pinto</authors>
			<keywords>Intrusion detection systems (IDSs),Network traffic classification,UNSW-NB15,Machine learning,Network security</keywords>
			<views>10</views>
			<downloads>5</downloads>
			<received_date>13-Mar.-2026</received_date>
			<revised_date>  30-May-2026</revised_date>
			<accepted_date>  6-Jun.-2026</accepted_date>
			<abstract>The proliferation of interconnected network infrastructures and IoT devices has significantly expanded the cyber-attack surface, requiring efficient Machine Learning-based Intrusion Detection Systems (IDSs). Although reference datasets like UNSW-NB15 exist, their official features impose limitations regarding flexibility and class imbalance. This study evaluates the impact of a custom data representation by constructing a new dataset from the original UNSW-NB15 PCAP files. We implemented a workflow to label packets, group unidirectional flows and extract a reduced set of 21 features, comparing this representation with the official 49-feature UNSW-NB15 set using different ML architectures in binary and multi-class classification tasks. Results indicate that the custom dataset achieves competitive performance despite a significant reduction in file size and the number of features. Notably, the custom representation effectively balances detection accuracy with computational efficiency, offering a viable strategy for environments with strict operational constraints, such as edge nodes or IoT gateways.</abstract>
		</paper>


