# DNS over HTTPS Tunneling Detection System Based on Selected Features via Ant Colony Optimization
## 4 Experimental Results and Discussion
### Feature Analysis and Discussion  
Feature Feature selection is a critical step in handling large datasets, as it reduces dimensionality, enhances model performance, and mitigates overfitting caused by irrelevant or redundant features. An excessive number of features can introduce noise, increase computational complexity, and degrade model performance, particularly in large-scale data processing. Effective feature selection not only improves processing efficiency and reduces storage requirements but also ensures the inclusion of relevant features, thereby enhancing both model accuracy and interpretability. The proposed method reduces the total number of dataset features to 15 for both classification scenarios, ensuring optimal performance. The selected features for each scenario, along with their corresponding importance values, are presented in Figures 7 and 8,providing insights into their contributions to model predictions. Among these features, _PacketLengthMode_ is identified as the most influential in both scenarios. In contrast, _PacketLengthCoefficientofVariation_ in the binary classification scenario and _PacketTimeMode_ in the multiclass classification scenario exhibit the lowest feature importance, indicating their minimal impact on model performance. Furthermore, Figure 9 highlights the mutual features selected in both classification tasks, emphasizing the common attributes that contribute to consistent model behavior across scenarios. Figure 8: ACO-based feature subsets and their feature importance values for multiclass (NoN-DoH, DoH-benign, DoH-malicious). Figure 7: ACO-based feature subsets and their feature importance values for binary class (DoH-benign and DoH-malicious). To further assess the generalizability of the proposed models and ensure robustness beyond a single train-test split, a 5-fold CV was applied in addition to the hold-out test set evaluation. This method evaluates model performance across multiple, diverse subsets of the data, providing a more comprehensive view of its stability. As expected, a slight decrease in performance metrics was observed during cross-validation. This modest drop is anticipated and considered a positive indication that the models are not overfitted to a particular split and are capable of generalizing well to various dataset samples. Figures 10 and 11 show a comparative chart and provide detailed visual representations of performance accuracies with all features against selected features for all classifiers in both classification tasks. \begin{table}
\begin{tabular}{c c c c c} \hline
**Classifiers** & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline XGBoost & 0.928 & 0.931 & 0.932 & 0.939 \\ \hline KNN & 0.941 & 0.939 & 0.956 & 0.957 \\ \hline RF & 0.952 & 0.928 & 0.925 & 0.943 \\ \hline CNN & 0.933 & 0.921 & 0.922 & 0.925 \\ \hline \end{tabular}
\end{table} 
Table 5: Performance metrics of the multiclass class scenario based on ALL features. \begin{table}
\begin{tabular}{c c c c c} \hline
**Classifiers** & **Validation Types** & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline \multirow{2}{*}{XGBoost} & Hold-out Test Set & 0.993 & 0.999 & 0.999 & 0.999 \\ \cline{2-5}  & 5-Fold CV & 0.976 & 0.982 & 0.981 & 0.981 \\ \hline \multirow{2}{*}{KNN} & Hold-out Test Set & 0.986 & 0.999 & 0.999 & 0.999 \\ \cline{2-5}  & 5-Fold CV & 0.969 & 0.984 & 0.983 & 0.982 \\ \hline \multirow{2}{*}{RF} & Hold-out Test Set & 0.995 & 1.00 & 1.00 & 1.00 \\ \cline{2-5}  & 5-Fold CV & 0.977 & 0.989 & 0.983 & 0.986 \\ \hline \multirow{2}{*}{CNN} & Hold-out Test Set & 0.985 & 0.998 & 0.987 & 0.999 \\ \cline{2-5}  & 5-Fold CV & 0.968 & 0.983 & 0.986 & 0.984 \\ \hline \end{tabular}
\end{table} 
Table 7: Performance classifiers in the multiclass classification scenario based on ACO-selected features.