## 3 Materials and Methods
### Analyzing the Dataset
#### 3.5.2 Entropy  
In the context of classification in supervised learning, entropy is often used to measure a group's impurity. It is used to analyze the relevance of a split in a decision tree, where the goal is to select the split that results in the most homogeneous subgroups (i.e., subgroups with the lowest entropy) [33]. Overall, the use of entropy in classification helps to identify splits that result in more homogeneous and pure sub-groups, which can improve the accuracy and effectiveness of the model. The choice of the best entropy measure for a particular problem depends on the specific requirements and characteristics of the problem. In the context of classification in supervised learning, Shannon entropy is the most commonly used entropy measure. It is defined as the sum of the probabilities of all possible outcomes multiplied by the log of the probability of each outcome. It provides a simple and intuitive way to quantify the impurity of a group, and is effective in decision tree learning and other classification algorithms [33]. The equation for Shannon entropy is as follows:  
\[H(X)=-\sum_{i=1}^{n}p_{xi}\text{log}_{2}\,p_{xi} \tag{2}\]  
where \(H(X)\) represents the Shannon entropy of the random variable \(X\), \(n\) is the number of possible outcomes of \(X\), and \(p(xi)\) is the probability of the i-th outcome of \(X\). The features obtained are characterized according to the entropy value, where a lower entropy provides the idea of higher information gain. This way, with a Python script, the best features are  
Figure 7: Pearson correlation heatmap for dataset. selected according to the entropy calculated. The best 10 and 20 features from both datasets are shown below in Table 4.  
This research employs the idea of multiclass classification through cross-evaluation of the proposed dataset with one of the most popular botnet datasets, BoT-IoT [17]. Feature reduction for the BoT-IoT dataset is also crucial for a comprehensive machine learning analysis. The researchers and the team at the University of New South Wales (UNSW) provided detailed information about the dataset and utilized techniques such as correlation coefficient and chi-square tests to identify the best features for their dataset. These methods allowed for the reduction of the dataset to only the most informative and relevant features, facilitating more efficient and accurate analysis. The dataset and feature information, as well as the best features, are accessible through the dataset database, which can be accessed through a web portal provided accordingly by the researchers [17]. The BoT-IoT dataset comprises a total of 46 distinct features. The best 10 and 20 features from the BoT-IoT dataset are presented in Table 5 accordingly. The cross-evaluation of data in this study was conducted using a BoT-IoT dataset consisting of 3 gigabytes of data. The 3 GB of the dataset contained 12% normal network traffic and 88% attack traffic. In order to optimize the analysis, the top 10 and top 20 features were utilized in the process. Figure 8 showcases the dataset statistics for 3 GB of dataset from BoT-IoT that has been implemented in the cross evaluation process. \begin{table}
\begin{tabular}{l l} \hline \hline
**Best 10 Features** & **Remaining 10 Features for Best 20** \\ \hline RecMean & FlowSrcIPRate \\ \hline RecMin & FlowDstIPRate \\ \hline RecMax & SrcPortRate \\ \hline FwdPackets/s & DstPortRate \\ \hline BwdPackets/s & SrcIPPktsCount \\ \hline SrcIPfwdConn & DstIPPktsCount \\ \hline DstIPBwdConn & BwdPktsCount \\ \hline FlowID & ProtocolNum \\ \hline FlowState & RecordTime \\ \hline ArgusSeq & FwdPktsCount \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Best 10 and best 20 features of the generated dataset.