# DNS over HTTPS Tunneling Detection System Based on Selected Features via Ant Colony Optimization
## 4 Experimental Results and Discussion
### State of the Art Comparison  
In this section, the proposed method is compared with other methods in which metaheuristic optimization algorithms, such as the GA, PSO, ABC, and LOEO, have been deployed for the purpose of selecting effective features in the IDS field in general and DoH detection in particular. Since studies that used the CIRA-CIC-DoHBrw-2020 dataset based on metaheuristic optimization algorithms were not sufficient, other studies that relied on other benchmark datasets in the IDS field, such as UNSW-NB15 [39] and ISCXIDS2012 [40], were included in the comparison. Studies that focused exclusively on one scenario (binary class or multiclass) with respect to feature selection and classification performance accuracy are reported as not applied (N/A) in Table 12. For example, ref. [20] employed the PSO algorithm and achieved an accuracy of 97.2% for an exclusively binary scenario, selecting all the statistical features in the CIRA-CIC-DoHBrw-2020 dataset. Similarly, ref. [23] focused exclusively on the multiclass scenario with a high classification accuracy rate of 98.9 using 25 features from the total features of the ISCXIDS2012 dataset via ABC optimization, leaving the binary scenario. Notably, including all or most of the dataset features used leads to an increase in computational complexity or a decrease in convergence efficiency for the metaheuristic optimization algorithm. In contrast, studies such as studies [21; 22], which rely on selecting the minimum number of features with 12 features as a maximum for different benchmark datasets and apply optimization algorithms such as the GA and LOEO, which exclusively focus on multiclass scenarios, obtain relatively lower classification accuracies  
\begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**MLs**} & **Computational Complexity with All Features** & **Computational Complexity with ACO-based Selected Features** & **Speed up effect of Feature Selection** \\ \hline KNN & \(O(n\cdot d)\) & \(O(n\cdot d^{\prime})\) & bring down distance calculations between features, accelerating classification process. \\ \hline \multirow{2}{*}{XgBoost} & \multirow{2}{*}{\(O(n\cdot d\cdot\log n)\)} & \multirow{2}{*}{\(O(n\cdot d^{\prime}\cdot\log n)\)} & bring down tree depth and node splits, speeding up classification process. \\ \hline RF & \(O(m\cdot n\cdot d\cdot\log n)\) & \(O(m\cdot n\cdot d^{\prime}\cdot\log n)\) & decrease feature evaluations in each tree, speeding up classification process. \\ \hline \multirow{2}{*}{CNNs} & \multirow{2}{*}{\(O(m\cdot d\cdot k^{2}.c.l)\)} & \multirow{2}{*}{\(O(m\cdot d^{\prime}\cdot k^{2}.c.l)\)} & decrease input channels and convolution operations, speeding up classification process \\ \hline \hline \end{tabular}  
* Where, \(n\) is the number of training samples in each classifier, \(d\) represent the number of all features, \(d^{\prime}\) is the number of selected features, where (\(d^{\prime}<d\)), \(m\) is the number of decision trees in RF, and \(\log n\) represents the logarithmic complexity due to tree-based structures. Furthermore, \(k^{2}\) is the kernel size, \(c\) is the layer per filter, and \(l\) is number of convolutional layers in CNNs.  
\end{table}
Table 11: Effect of feature selection on computational complexity in KNN, XGBOOST, RF, and CNNs.  
ranging between 94.5 and 97.6, respectively. Notably, the proposed method in this study selected a moderate number of features (15 features per scenario) from the CIRA-CIC-DoHBrw-2020 dataset via ACO, which achieved a balance between dimensionality and relevance and reported the highest performance accuracy compared with other methods for both binary and multiclass scenarios, which reached 99.99 and 99.55, respectively. This calls attention to the possibility of improving feature selection to achieve superior classification performance in various scenarios while maintaining the simplicity of the model.