# DNS over HTTPS Tunneling Detection System Based on Selected Features via Ant Colony Optimization
## 3 The Proposed Work
### Data Preprocessing  
Data preprocessing is a critical step in ML to ensure that the data are clean, consistent, and suitable for model training. Properly prepared data can significantly enhance model performance, improving accuracy, reducing errors, and ensuring that the model can be generalized well to unseen data. In this study, several data preprocessing techniques are used, including labeling, data cleaning, normalization, resampling for class balancing, and data splitting. For these preprocessing steps, the scikit-learn (sklearn) library is utilized as follows:  
1. Label Encoding sklearn's label encoder has been used to convert the categorical class labels of the dataset, Non-DoH, Benign-DoH, and Malicious-DoH, into numerical labels. This is necessary because most machine learning models are designed to work with numeric data, wherein label encoding converts class labels into integers that can be easily processed by the model.
2. Data Cleaning The noise and irrelevant data are cleaned using the imputation method along with inconsistencies in the dataset. This ensures that the data are more accurate, reducing the possibility of errors, which may affect the model's learning process.
3. Normalization To keep the features on the same scale, min-max scaling was implemented via Min-MaxScaler from sklearn; this technique rescales feature values within a range of 0-1 to avoid domination by large values in model training processes. The min-max scaling formula is as follows: \[x_{scaled}=\frac{x-x_{min}}{x_{max}-x_{min}}\] (6) where \(x\) is the original feature value and where \(Xmin\) and \(Xmax\) are the minimum and maximum values of the feature, respectively.
4. Resampling Since the CIRA-CIC-DoHBrw-2020 dataset is imbalanced, meaning that some classes have more samples than others do, SMOTE is used to balance the dataset classes. SMOTE generates synthetic samples for minority classes by interpolating between existing data points; in this way, it increases the number of samples for underrepresented classes without simply replicating existing instances from those classes. This helps the model learn from all classes more equally since the majority class bias is reduced, which again leads to better results for the minority classes [33]. Figure 6a,b Changes in the class label distributions for both binary class and multiclass scenarios before and after applying resampling via SMOTE.
5. Data Splitting A training-testing split for the dataset using sklearn's train_test_split is performed, allocating 70% for training and the remaining 30% for testing. When a substantial portion of the model is trained on the majority of the data, using the remaining data to assess its  
\begin{table}
\begin{tabular}{c c c} \hline
**Traffic Type** & **Class** & **Count** \\ \hline Layer 1 & Non-DoH & 897,493 \\ Layer 1 & DoH & 269,643 \\ Layer 2 (DoH) & Benign-DoH & 19,807 \\ Layer 2 (DoH) & Malicious-DoH & 249,836 \\ \hline \end{tabular}
\end{table}
Table 3: Breakdown of traffic types and class counts in the CIRA-CIC-DoHBrw-2020 dataset.  
performance against unseen data provides accurate or nearly perfect performance in terms of its generalization ability.