# DNS over HTTPS Tunneling Detection System Based on Selected Features via Ant Colony Optimization
## 5 Conclusions  
This study presented an innovative dual-path feature selection framework, which leveraged ACO to optimize the detection of DoH and non-DoH traffic. The integration of ACO-driven feature selection markedly enhanced classifier performance across both binary (DoH-normal vs. DoH-malicious) and multiclass (non-DoH, DoH-normal, DoH-malicious) classification tasks. By employing ACO, 15 discriminative features were identified from the CIRA-CIC-DoHBrw-2020 dataset, enabling significant accuracy improvements in all evaluated machine learning tools, XgBoost, KNN, RF, and CNNs.  
In binary classification, XgBoostB, KNN, and RF achieved near-perfect accuracies (0.999), while CNNs exhibited marginally lower performance (0.998). For multiclass scenarios, RF emerged as the superior model (accuracy: 0.995), whereas CNNs demonstrated the lowest efficacy (0.985). These results highlight the critical role of ACO in optimizing feature subsets to bolster model discriminative power. Furthermore, the framework's efficiency was further validated through a 29% average reduction in execution time and computational complexity across all classifiers, which is attributable to the parsimonious feature set. Hyperparameter tuning via Gaussian optimization and class balancing with SMOTE ensured robust model generalization, corroborated by rigorous evaluation using Hold-out testing and 5-Fold CV.  
These findings underscore the efficacy of ACO-based feature selection in enabling high-accuracy, resource-efficient detection of encrypted traffic threats. The framework's scalability and performance advancements position it as a promising solution for real-time network security applications, which addresses both binary and multiclass traffic classification challenges with minimal computational overhead. Future research directions include applying the framework to other benchmark datasets in the intrusion detection domain to better assess its adaptability, robustness, and real-world applicability. Moreover, exploring advanced deep learning architectures and ensemble learning strategies could further improve detection performance.  
**Author Contributions:** Methodology, H.S.T.; Software, H.S.T.; Formal analysis, H.S.T.; Visualization, H.S.T.; Supervision, Z.K.A. and H.M.M.S. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This research received no external funding.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Ref.**} & **Feature selection Method** & \multirow{2}{*}{**Dataset**} & **No. of Features for Binary Class Class Class Class** & \multirow{2}{*}{\
\begin{tabular}{c} **No. of Features for Multiclass** \\ **Class** \\ \end{tabular} } & **Binary Class Accuracy (\%)** & \multirow{2}{*}{
\begin{tabular}{c} **Multiclass** \\ **Accuracy (\%)** \\ \end{tabular} } \\ \hline
[21] & GA & CIRA-CIC-DoHBrw-2020 & N/A & 12 & N/A & 94.5 \\
[20] & PSO & CIRA-CIC-DoHBrw-2020 & 28 & N/A & 97.2 & N/A \\
[22] & LOEO & UNSW-NB15 & N/A & 11 & N/A & 97.6 \\
[23] & ABC & ISCXIDS2012 & N/A & 25 & N/A & 98.9 \\ Proposed & ACO & CIRA-CIC-DoHBrw-2020 & 15 & 15 & 99.99 & 99.55 \\ \hline \hline \end{tabular}
\end{table}
Table 12: State-of-the-art comparisons.  
Data Availability Statement: The data presented in this study are openly available on the University of New Brunswick's website at [[https://www.umb.ca/cic/datasets/dohbrw-2020.html](https://www.umb.ca/cic/datasets/dohbrw-2020.html)]([https://www.umb.ca/cic/datasets/dohbrw-2020.html](https://www.umb.ca/cic/datasets/dohbrw-2020.html)).