| No. | FEATURE NAME | ILLUSTRATION |
| 1 | DURATION | Duration of flow entry |
| 2 | PROTOCOL_TYPE | Protocol type of traffic |
| 3 | BYTES | Bytes of traffic |
| 4 | LAND | Source of flow entry |
| 5 | DROP | Action of flow entry |
| 6 | SDIP_COUNT | pks with same DIP for current flow entry |
| 7 | SDPORT_COUNT | pks with same DPORT for current flow entry |
| 8 | SDIP_ DPORT_RATE | rate of pks (with same DPORT same DIP) |
| 9 | SDIP_DDPORT_RATE | rate of pks (with different DPORT same DIP) |
| 10 | DHOST_SRV_DHOST_RATE | rate of pks (with same DPORT; different DIP) |
| 11 | FT_SDIP_COUNT | In current flow table, pks that have the same DIP with current flow entry |
| 12 | FT_SDIP_SDPORT_COUNT | In current flow table, pks with same DPORT and same DIP |
| 13 | FT_SDIP_SDPORT_RATE | In current flow table, rate of pks (with same host same DPORT) |
| 14 | FT_SDIP_DDPORT_RATE | In current flow table, rate of pks (with different host different DPORT) |
| 15 | FT_DDIP_DSPORT_RATE | In current flow table, rate of pks(with different host different DPORT) |
| 16 | FT_SDIP_DDIFF_SIP_RATE | In current flow table, rate of pks (with same host and DIP different DPORT) |