Stolfo et al. defined higher-level features that help in distinguishing normal connections from attacks [28].There are several categories of derived features.The KDDcup99 dataset has a total of 42 features.The last column is the label, and the other 41 features are divided into four categories: