# is it beneficial to use high-order n-grams as feature vectors for web anomaly detection?

i am studying about the use of n-gram models to classify web attacks based on several parameters like, requested resources, query parameters and attributes, characters distribution and so on. Most research papers use n-grams frequencies as feature vectors for their machine learning algorithms.

Ascii code only allows the use of 256 characters, so if i want to use 1-gram, my feature vector will have 256 dimensions, and for n-grams it will $$256^n\,$$ dimensions.

A feature vector with such a long dimension leads to the so called "curse of dimensionality".

The use of bi-grams frecuencies as feature vectors results in good accuracy by classification algorithms.

If the use of bi-grams gives greats results, the use of tri-grams give better results against bi-grams.

So, my question is as follows : If we increase n, we should have better results compared to lower values of n when classifying queries? Can i conclude that for example the use of 7-grams would produce greater accuracy when compared to 4-grams?

Thanks

• I think you're confusing dimensionality and possible value count. An n-gram will produce a feature vector of length n. But the number of possible n-grams from a vocabulary of size k will be (k to the power of n). – Vlad_Z Mar 14 '20 at 8:38
• The input here seems to be text, ie this is Natural Language Processing. The higher the N for your N-gram the more rare each N-gram will be. This increases the data amounts needed to give meaningful and general results. Anyway, for NLP you should probably look towards (word) embeddings instead of n-grams – Jon Nordby Mar 29 '20 at 18:04