## 3 Materials and Methods
### Feature Selection and Scoring  
In this section, the specifics of both the Chi-Square and Gini Index methodologies are discussed. The use of both Chi2 and the Gini Index serves a dual function of feature selection and scoring. This approach is crucial in pinpointing the key features that play a significant role in the detection of malicious activities.  
In the initial stage, the Chi2 algorithm was applied to evaluate the independence between each feature and the target variable. This further narrowed down the feature selection process, resulting in a reduced set of 105 features from the initial 266. Furthermore, feature scoring was utilised, focusing on pinpointing the most critical features for detecting malicious activity. The function (ChiSquareFeatureReduction(\(X\), \(Y\))) in Step:4 of Algorithm 2 provides an overview of the feature set (\(X\)) reduction, retaining the most informative features (ReducedFeatures), and computes _Chi2 Scores_ for the top 50 features, returning both for further analysis.  
\[\chi^{2}=\sum_{i=1}^{n}\frac{(O_{i}-E_{i})^{2}}{E_{i}} \tag{1}\]Equation (1) illustrates how the Chi2 statistic (\(\chi^{2}\)) measures the discrepancy between observed and expected frequencies in a feature set. It calculates the squared differences between observed (\(O_{i}\)) and expected (\(E_{i}\)) frequencies for each feature. The expected frequencies are derived assuming independence between variables. The sum (\(\sum\)) indicates that the calculations are performed for each feature, from \(i=1\) to \(i=n\), of these squared differences \((O_{i}-E_{i})^{2}\) divided by the expected frequencies (\(E_{i}\)), providing a measure of overall discrepancy from the expected distribution.  
In the second stage, the Gini Importance was applied to assess feature importance. Features were ranked according to their Gini Importance values, enabling the identification of a subset of the most influential features. Consequently, the feature count decreased from the original 266 to 50, streamlining the analysis for greater focus and efficiency. The function GiniImportance (\(\text{GiniImportance}\)(\(\text{ReducedFeatures}\), \(Y\))) explains the further reduction in the feature set (\(ReducedFeatures\)) from 150 to the top 50 features using the Gini importance criterion. It also calculates GiniScores for these features and returns them along with the TopFeatures set.  
\[\text{GI}(f)=\sum_{i\in 10}\frac{n_{t}}{n}\text{GG}(t,f) \tag{2}\]  
Equation (2) shows the utilisation of the Gini Importance (GI) metric for a feature \"\(f\)\". The GI is obtained by summing the Gini Gain (GG) across all trees in the ensemble, measuring the improvement in Gini impurity achieved by splitting on \"\(f\)\" in a particular tree. The dataset, which included extracted features, underwent division into training and testing sets, with 80% of the data allocated for training the models and the remaining 20% reserved for evaluating their performance by using Python's Scikit-Learn library as illustrated in Table 11. This division is illustrated by the function SplitData (\(\text{SplitData}\)(\(Data\), \(Ratio\))), which splits the input dataset (\(Data\)) into training and testing sets with the specified ratio (\(Ratio\)). It returns the training and testing sets as \(\mathcal{X}_{train}\) and \(\mathcal{X}_{test}\), respectively, for use in machine learning model training and evaluation.