## 5 Results
### Training and Testing Using the Minimum Number of Features with the RF Algorithm  
Multiple experiments were conducted using the RF algorithm and the features were manually reduced by following the process described above (Section 5.4). This process was repeated until two of the dataset prediction results fell below 50% and it was determined that the minimum number of features that could be used are as follows: total_fvolume, total_bvolume, min_fpktl, mean_fpktl, max_fpktl, min_bpktl, mean_bpktl, max_bpktl, std_bpktl, sflow_flyytes, sflow_byytes, bpsh_cnt, duration, min_active, mean_active, max_active and min_idle. The precision, recall and f1-score results for testing all the datasets using the minimum number of features with the RF algorithm can be seen in Table 14 and the confusion matrices can be seen in Table 15.  
Figure 13 compares the results of detecting the Zeus malware between using all the features and the minimum number of features when tested with the DT algorithm, and shows that the prediction results of dataset1, dataset2, dataset3, dataset7, dataset8 and dataset9 were all within 5% of each other and that dataset4, dataset5 and dataset6 were within 16% of each other. Figure 12 compares the results of detecting the benign samples between using all the features and the minimum number of features and shows that the prediction results of all the datasets were within 1% of each other.  
Figure 14 compares the true positive results of all three algorithms when tested using the minimum number of features, and the malware prediction results for all the datasets apart from dataset6 were within 10% of each. Dataset6 was an outlier with a difference of 36%, and in this case, the DL algorithm performing the best with a prediction result of 74% and the DT performing the worst with a prediction result of 38%. Figure 15 compares the results of detecting the benign samples between using all the features and the minimum number of features and shows that the prediction results of all the datasets were within 2% of each other.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Dataset** & **Benign** & **Benign** & **Benign** & **Malware** & **Malware** & **Malware** \\
**Name** & **Precision Score** & **Recall Score** & **f1-Score** & **Precision Score** & **Recall Score** & **f1-Score** \\ \hline Dataset1 & 1 & 1 & 1 & 1 & 1 \\ Dataset2 & 0.93 & 1 & 0.95 & 1 & 0.93 & 0.95 \\ Dataset3 & 0.94 & 1 & 0.97 & 1 & 0.93 & 0.96 \\ Dataset4 & 0.67 & 0.89 & 0.77 & 0.84 & 0.57 & 0.68 \\ Dataset5 & 0.7 & 1 & 0.83 & 1 & 0.58 & 0.73 \\ Dataset6 & 0.62 & 1 & 0.77 & 1 & 0.39 & 0.56 \\ Dataset7 & 0.99 & 1 & 0.99 & 1 & 0.99 & 0.99 \\ Dataset8 & 0.99 & 0.89 & 0.93 & 0.9 & 0.99 & 0.94 \\ Dataset9 & 0.96 & 1 & 0.98 & 1 & 0.96 & 0.98 \\ \hline \hline \end{tabular}
\end{table}
Table 14: Predication results when using the RF algorithm with minimum features.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Dataset** & **Benign** & **Benign** & **Benign** & **Malware** & **Malware** & **Malware** \\
**Name** & **Precision Score** & **Recall Score** & **f1-Score** & **Precision Score** & **Recall Score** & **f1-Score** \\ \hline Dataset1 & 272,425 & 272,233 & 192 & 272,425 & 271,328 & 1097 \\ Dataset2 & 66,009 & 65,961 & 48 & 66,009 & 61,230 & 4779 \\ Dataset3 & 38,282 & 38,256 & 26 & 38,282 & 35,641 & 2641 \\ Dataset4 & 200,000 & 178,346 & 21,654 & 200,000 & 114,030 & 85,970 \\ Dataset5 & 35,054 & 35,029 & 25 & 35,054 & 20,221 & 14,833 \\ Dataset6 & 6049 & 6047 & 2 & 6049 & 2352 & 3697 \\ Dataset7 & 11,864 & 11,855 & 9 & 11,864 & 11,743 & 121 \\ Dataset8 & 10,204 & 9033 & 1171 & 10,204 & 10,081 & 123 \\ Dataset9 & 7152 & 7148 & 4 & 7152 & 6849 & 303 \\ \hline \hline \end{tabular}
\end{table}
Table 15: Confusion matrix for testing the RF algorithm with minimum features.  
Figure 14: True positive rates compared for all three algorithms when using the minimum number of features.  
Figure 13: RF Zeus prediction results compared between using the minimum number of features and all the features in Feature set1.