## 5 Results
### Training and Testing with the Minimum Number of Features with the DL Algorithm  
Following the process discussed in Section 5.4, it was determined that the minimum number of features that could be used by the DL algorithm are as follows: total_fvolume, total_ppackets, total_bvolume, min_fpktl, mean_fpktl, max_fpktl, std_fpktl, min_bpktl, mean_bpktl, max_bpktl, std_bpktl, sflow_fbytes, sflow_bbytes, bpsh_cnt, duration, min_active, mean_active, max_active, min_idle and max_idle. The precision, recall and f1-score results can be seen in Table 10 and the confusion matrices can be seen in Table 11.  
Figure 8: Flow diagram showing the feature redaction process.  
Figure 7: Feature impact scores.  
Figure 9 compares the results of detecting the Zeus malware between using all the features and the minimum number of features. The prediction results of dataset1, dataset2, dataset3, dataset4, dataset7, dataset8 and dataset9 were all within 5% of each other, dataset5 was within 9% and dataset6 was within 12%. Figure 10 compares the results of detecting the benign samples between using all the features and the minimum number of features when tested with the deep learning algorithm and shows that the prediction results of all the datasets were within 1% of each other.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Dataset** & **Benign** & **Benign** & **Benign** & **Malware** & **Malware** & **Malware** \\
**Name** & **Precision Score** & **Recall Score** & **f1-Score** & **Precision Score** & **Recall Score** & **f1-Score** \\ \hline Dataset1 & 0.98 & 0.97 & 0.97 & 0.97 & 0.98 & 0.97 \\ Dataset2 & 0.9 & 0.97 & 0.93 & 0.97 & 0.89 & 0.93 \\ Dataset3 & 0.9 & 0.97 & 0.94 & 0.97 & 0.9 & 0.93 \\ Dataset4 & 0.66 & 0.95 & 0.78 & 0.92 & 0.51 & 0.66 \\ Dataset5 & 0.67 & 0.97 & 0.79 & 0.95 & 0.51 & 0.67 \\ Dataset6 & 0.79 & 0.99 & 0.88 & 0.98 & 0.74 & 0.85 \\ Dataset7 & 0.97 & 0.97 & 0.97 & 0.97 & 0.97 & 0.97 \\ Dataset8 & 0.91 & 0.94 & 0.92 & 0.94 & 0.9 & 0.92 \\ Dataset9 & 0.92 & 0.98 & 0.95 & 0.98 & 0.91 & 0.95 \\ \hline \hline \end{tabular}
\end{table}
Table 10: Predication results when using the DL algorithm with minimum features.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Dataset** & **Benign** & **Benign** & **Benign** & **Malware** & **Malware** & **Malware** \\
**Name** & **Precision Score** & **Recall Score** & **f1-Score** & **Precision Score** & **Recall Score** & **f1-Score** \\ \hline Dataset1 & 272,425 & 265,049 & 7376 & 272,425 & 266,052 & 6373 \\ Dataset2 & 66,009 & 64,028 & 1981 & 66,009 & 58,811 & 7198 \\ Dataset3 & 38,282 & 37,298 & 984 & 38,282 & 34,304 & 3978 \\ Dataset4 & 200,000 & 190,820 & 9180 & 200,000 & 102,371 & 97,629 \\ Dataset5 & 35,054 & 34,103 & 951 & 35,054 & 17,996 & 17,058 \\ Dataset6 & 6049 & 5963 & 86 & 6049 & 4499 & 1550 \\ Dataset7 & 11,864 & 11,553 & 311 & 11,864 & 11,535 & 329 \\ Dataset8 & 10,204 & 9575 & 629 & 10,204 & 9233 & 971 \\ Dataset9 & 7152 & 7015 & 137 & 7152 & 6544 & 608 \\ \hline \hline \end{tabular}
\end{table}
Table 11: Confusion matrix for testing the DL algorithm with minimum features.  
Figure 9: Zeus prediction results when tested using the minimum number of features.