In the preprocess part, we use the packet sniffer, which is built with Jpcap library, to store network packet information including IP header, TCP header, UDP header, and ICMP header from each promiscuous packet. After that, the packet information is divided by considering connections between any two IP addresses (source IP and destination IP) and collect all records every 2 seconds as shown in the preprocess part in Figure 3. Each record consists of 13 data features and an answer class as shown in Table 1. Examples of the data records obtained from the preprocess part are shown below