Feature Selection in Weka - Explorer - v3.7.2
-----------------

RSAR selected 
- Cookie, URL = 0.167.

InfoGain selected
- Cookie = 0.996
- Index = 0.295
- Payload = 0.138
- URL = 0.126

Consistency selected
- Cookie = 100%

Cookie contains only JSSession=<value> and is not an attribute upon which to predict new attacks.

Index is likely to be useful only because the "anom" objects never have a value above 25064. "norm" objects can have 35999.  
35999-25064=10935, 10935/35999=0.303758;  showing that the 0.295 is *likely* to be discerning most of the 0.303 difference (between the labelled objects of norm and anom).

URL (0.126) and Payload (0.138) are interesting; however, according to the above results, neither will discern much more than (0.126+0.138=0.264) a quarter of anomalous inputs.