## 4 Research Methodology
### Machine Learning Algorithms  
The ML algorithms used for this research are discussed in this section, and they are supervised machine learning algorithms as these are used and are the most suitable for classification problems, as discussed by [55]. The machine learning algorithms used during this research include the decision tree (DT) algorithm, the random forest (RF) algorithm and the keras neural network (KNN) deep learning algorithm.  
The decision tree algorithm is a common machine learning algorithm that can be used for classification problems [56] and is especially useful when used for binary classification problems [56]. For this reason, the decision tree algorithm is well suited for this prediction problem because this analysis is trying to determine if the network flow is malicious (Zeus banking malware traffic), or benign. The authors of [57] also state that the decision tree algorithm can produce good prediction results.  
The random forest (RF) algorithm works by building and combining multiple decision trees [58]. It can be more efficient and provide better prediction results than the decision tree algorithm [59], and it reduces the possibility of overfitting [60]. It is important to tune the parameters to try and increase the prediction accuracy when using the RF algorithm; however, it is difficult to predict the best parameters ahead of time as the parameters are selected based on trial and error. One of these parameters is the number of trees built during the training and testing of the data. The author of [61] states that building more than 128 trees provides no significant gain in the accuracy and can increase costs. The authors of [61] also state that the optimum number of trees for the random forest classifier was found to be between 64 and 128. For this empirical analysis, the random forest algorithm was coded to build between 64 and 128 decision trees, and once the training was complete, the optimal number of trees was selected based on the best prediction results.  
Keras is a popular neural network library implemented in Python [62] and can be used for classification problems such as the one examined during this research [63]. The keras neural network (KNN) deep learning algorithm was used for training and testing the datasets and for this empirical analysis, a sequential KNN model [64] was used, which means that the output of one layer is input into the next layer. For this research, the deep learning model consisted of one input layer, three hidden layers and one output layer, and  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Dataset Type** & **Malware Name/Year** & **Number of Flows** &
\begin{tabular}{c} **Name of Dataset for** \\ **This Paper** \\ \end{tabular} \\ \hline Malware & Zeus/2022 & 272,425 & Dataset1 \\ Benign & N/A & 272,425 & Dataset2 \\ \hline Malware & Zeus/2019 & 66,009 & Dataset2 \\ Benign & N/A & 66,009 & Dataset3 \\ \hline Malware & Zeus/2019 & 38,282 & Dataset3 \\ Benign & N/A & 38,282 & Dataset4 \\ \hline Malware & Zeus/2014 & 200,000 & Dataset4 \\ Benign & N/A & 200,000 & Dataset5 \\ \hline Malware & Zeus/2014 & 35,054 & Dataset6 \\ Benign & N/A & 35,054 & Dataset5 \\ \hline Malware & Zeus/2014 & 6049 & Dataset6 \\ Benign & N/A & 6049 & Dataset6 \\ \hline Malware & ZeusPanda/2022 & 11,864 & Dataset7 \\ Benign & N/A & 11,864 & Dataset8 \\ \hline Malware & Ramnit/2022 & 10,204 & Dataset8 \\ Benign & N/A & 10,204 & Dataset9 \\ \hline Malware & Citadel/2022 & 7152 & Dataset9 \\ Benign & N/A & 7152 & Dataset9 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Datasets used in this research.  
a graphical representation of this can be seen in Figure 3. It is important to note that only one of the datasets was used for training and the remaining datasets were used for testing.