Behavioral Features for Network Anomaly Detection