# DNS over HTTPS Tunneling Detection System Based on Selected Features via Ant Colony Optimization
## 3 The Proposed Work
### Feature Selection Stage  
The method used to select the most influential features mimics the ant's method of finding the shortest and easiest path to food. First, to explore subsets of features repeatedly, the artificial ant starts by preparing equal levels of pheromones for all the features in the dataset. Consequently, based on the pheromone level and Heuristic information (feature importance values), the features are selected probabilistically by each ant, thus forming subsets of features. The next step is to evaluate these subsets formed using the accuracy function of the four used classifiers. This process continues until the specified number of iterations is reached, leading to the enhancement of the features with high pheromones and the gradual evaporation of the features with lower influence to stagnate. Thus, by repeating this process, the search process of the algorithm ACO is gradually improved by referring to the most influential set of features. This approach improves the performance of the classifiers, reducing the dimensions of the CIRA-CIC-DoHBrw-2020 dataset, reducing the computational efficiency and accelerating the model's access to the decision without compromising the predictive accuracy. Figure 4 illustrates all the steps of the methodology followed to select the most important features. Mathematically, the goal is to identify a set of features \(S_{k}\) that achieves the highest classification accuracy as an evaluation function, where \(S_{k}\ \subseteq F\) and \(F\) represent all the features in the CIRA-CIC-DoHBrw-2020 dataset (29 statistical features). The ACO approach used for feature selection treats each feature \(F_{i}\) as a node in the graph \(G=(F,E)\), where the edge \(E\) represents the transactions between features. The probability of selecting each feature depends on the level of pheromone density \(T_{i}(t)\) at iteration \(t\). A higher pheromone density indicates that a feature contributes significantly to the evaluation function. To enhance the selection process, the heuristic value \(n_{i}\), derived from the feature importance of \(F_{i}\), is calculated as  
\[n_{i}=Feature\ Importance\ (F_{i}) \tag{1}\]  
where \(n_{i}\) represents the heuristic value for feature \(F_{i}\), which prioritizes features with greater relevance on the basis of their importance. The mechanism for iteratively selecting a specific feature by ants for each subset is performed through the following probability:  
\[P_{i}^{K}(t)=\frac{T_{i}(t)^{\alpha}*n_{i}^{\beta}}{\sum_{j\ \in\ NotYet}\ T_{j}(t)^{ \alpha}*n_{j}^{\beta}} \tag{2}\]  
where \(P_{i}^{K}(t)\) is the probability of selecting feature \(F_{i}\) for subset \(S_{k}\) at iteration \(t\). The term \(T_{i}(t)\) denotes the pheromone density of \(F_{i}\), while \(n_{i}\) is the heuristic value. The parameters \(\alpha\) and \(\beta\) control the influence of the pheromone density and heuristic value, respectively. The summation in the denominator accounts for all features in the set \(NotYet\), which comprises features not yet included in \(S_{k}\). Ants iteratively construct subsets \(S_{k}\), stopping when a termination condition (e.g., 50 iterations) is met. Each subset is then evaluated  
Figure 4: The proposed ACO-based feature selection. on the basis of the classification accuracy of a machine learning model, and subsets with higher accuracies are favored. To avoid stagnation and local optima, the pheromone levels undergo evaporation and reinforcement. Pheromone evaporation reduces the influence of previous iterations and is modeled as follows:  
\[T_{i}\left(t+1\right)=\left(t-\rho\right)*T_{i}(t) \tag{3}\]  
where \(T_{i}\left(t+1\right)\) is the updated pheromone density for feature \(F_{i}\), and \(\rho\) is the evaporation rate, which is between 0 and 1. The reinforcement phase increases the pheromone level for effective features on the basis of their performance.