I am trying to build a model (Machine Learning) in order to detect malicious network traffic. At first, I am trying classify network traffic as malware or benign.
After predicting the malware part, I want to classify it into different malware families.
I have a dataset that includes 90 features (https://www.nfstream.org/docs/api) and currently am trying to figure out which features are important for malware detection.
each line in the dataset represents a session and includes features such as src_ip, dst_ip, protocol, and much more.
After reading much online, I couldn't reach to a conclusion as to which feature can point to a network malware?
In your experience, what features should I focus on? any additional information or articles would be much appreciated.