diff --git a/B_Root_Anomalies/README.md b/B_Root_Anomalies/README.md
index 05c10ab..4b01b5a 100644
--- a/B_Root_Anomalies/README.md
+++ b/B_Root_Anomalies/README.md
@@ -15,4 +15,5 @@ recordID label
 where recordID looks like:
 ```
 timestamp-sourceIP-sourceport-destIP-destport
-```
\ No newline at end of file
+```
+and label can be A (attack) or B (benign)
\ No newline at end of file