## 4 Results and Discussion  
This section details the testing of the GA-HDLAD system and the results obtained. The CTU-13 dataset [52], consisting of 25,677 instances with two class labels (botnet and normal traffic), was employed in the experiments (see Table 2). The botnet traffic comprises numerous packets sent either by a botmaster or a system imitating one, whereas normal traffic consists of benign packets sent from one location to another without malicious intent. The following preprocessing steps were applied to the dataset to enhance the validity and robustness of the experimental results:  
* Handling of missing values: Instances with missing values were removed to maintain the integrity and consistency of the dataset. This step was taken to ensure that incomplete data did not affect the accuracy and reliability of the analysis. * Normalization: Feature values were normalized using Min-Max scaling, transforming the features into a range of [0, 1]. This procedure was necessary to prevent features with larger numerical ranges from dominating the learning process, ensuring balanced feature representation. * Data splitting: The dataset was divided into training and testing sets in a 70/30 ratio. Here, 80% (or 70%) of the data was allocated for training the GA-HDLAD model, and the remaining 20% (or 30%) was used for testing. The random division of data ensures that the model is evaluated on unseen instances, which is crucial for assessing its generalization capabilities. These preprocessing steps were critical in ensuring the integrity of the results and improving the model's ability to accurately classify botnet and normal traffic. Table 2 summarizes the dataset used in the experiments. In Figure 1, the confusion matrices highlight the classification performance of the GA-HDLAD approach for both 70:30 and 60:40 TRPM/TSPH splits. The results show that the model accurately distinguishes between botnet and normal traffic in both the training and testing phases. The matrices illustrate that the GA-HDLAD model achieves high accuracy with very few misclassifications for both botnet and normal samples across different data splits. These results confirm the model's strong capability in detecting botnet traffic while maintaining low error rates, making it a reliable tool for IoT anomaly detection. \begin{table}
\begin{tabular}{c c} \hline \hline
**Class** & **No. of Instances** \\ \hline Botnet & 4775 \\ Normal & 20,902 \\ Total Instances & 25,677 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Summary of dataset with botnet and normal class instances. Table 3 and Figure 2 illustrate the GA-HDLAD system's ability to detect botnets using a 70:30 split of TRPM/TSPH. The results reveal the system's effectiveness in identifying both types of samples, with detailed performance metrics for each class. For the botnet class in the TRPM dataset, the algorithm achieves an accuracy of 98.05%, precision of 95.85%, recall of 98.05%, F-score of 96.94%, and AUC score of 98.72%. For the normal class, the model shows an even stronger performance, with an accuracy of 99.40%, precision of 99.72%, recall of 99.40%, F-score of 99.56%, and AUC score of 98.72%. These high scores indicate that the GA-HDLAD system is highly effective at correctly identifying both normal and botnet traffic. When tested on the TSPH data, which accounts for 30% of the dataset, the model demonstrates similar robustness. For the botnet class, the model achieves an accuracy of 99.01%, precision of 96.71%, recall of 99.01%, F-score of 97.84%, and AUC score of 99.27%. For the normal class, it exhibits an accuracy of 99.53%, precision of 99.86%, recall of 99.53%, F-score of 99.70%, and AUC score of 99.27%. The high values across these metrics confirm that the GA-HDLAD model is not only effective in detecting anomalies but is also consistent across  
Figure 1: Confusion matrices for training and testing phases of the GA-HDLAD model for different data splits.