# DNS over HTTPS Tunneling Detection System Based on Selected Features via Ant Colony Optimization
## 4 Experimental Results and Discussion
### Performance Evaluation Metrics  
In this study, four key performance metrics are used--accuracy, precision, recall, F1 score, and the confusion matrix--to evaluate the effectiveness of the proposed method. These metrics collectively provide a comprehensive understanding of the model's classification performance across various aspects, including overall accuracy, the handling of positive instances, and the balance between precision and recall.  
Accuracy, as the most general metric, measures the overall correctness of a model. It is calculated by dividing the total number of correct predictions (both True Positives _TP  
Figure 6: (**a**) Class label distribution for the binary class scenario (DoH-benign vs. DoH-malicious) before and after resampling using SMOTE. (**b**) Class label distribution for the multiclass scenario (Non-DoH, DoH-benign, DoH-malicious) before and after resampling using SMOTE.  
and True Negatives _TN_) by the total number of samples [34]. This metric is especially useful when the dataset is balanced, as it provides an overall measure of performance Equation (7).  
\[Accuracy=\frac{TP+TN}{total\ samples} \tag{7}\]  
Precision, on the other hand, focuses on the model's ability to correctly predict positive instances via Equation (8). It calculates how many of the predicted positive instances are actually correct, making it a crucial metric when False Positives (_FP_) need to be minimized [35].  
\[Precision=\frac{TP}{TP+FP} \tag{8}\]  
Recall (also known as sensitivity) evaluates how well the model captures all _TP_ instances via Equation (9). It measures the proportion of actual positive instances that are correctly identified, making it important when missing positive instances is costly [36]  
\[Recall=\frac{TP}{TP+FP} \tag{9}\]  
The F1 score balances both precision and recall by calculating their harmonic means, providing a single metric that is particularly useful when dealing with imbalanced datasets Equation (10). The F1 score helps balance the trade-offs between precision and recall [37]:  
\[F1-Score=2*\ \frac{Precision*\ Recall}{Precision+Recall} \tag{10}\]  
The confusion matrix is an essential tool for evaluating the performance of an ML classification model. It shows a breakdown of the predictions of the model versus the actual results, allowing you to see how well your model is performing and where it may fail. The matrix itself is a table where the rows and columns indicate different categories [38]. Each cell in the table shows the number of predictions for a particular category from the predicted categories versus the actual categories.  
The Chi-square test was applied to demonstrate the significant impact of ACO-based feature selection on model performance compared to the same model without feature selection. For instance, when the Random Forest algorithm was used with ACO-selected features, it achieved the highest accuracy, significantly outperforming the model without feature selection. The _p_-values for the two classification scenarios were 0.0012 and 0.0007, respectively.  
In addition to evaluating classification performances on the hold-out test set, 5-fold cross-validation (5-Fold CV) was employed to further validate the consistency and robustness of the results. This method involves dividing the training data into five subsets, ensuring that each model is trained and tested across varied data partitions.