# DNS over HTTPS Tunneling Detection System Based on Selected Features via Ant Colony Optimization
## 4 Experimental Results and Discussion
### Feature Analysis and Discussion
\begin{table}
\begin{tabular}{c c c c c c} \hline
**Classifiers** & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline XGBoost & 0.928 & 0.931 & 0.932 & 0.939 \\ \hline KNN & 0.941 & 0.939 & 0.956 & 0.957 \\ \hline RF & 0.952 & 0.928 & 0.925 & 0.943 \\ \hline CNN & 0.933 & 0.921 & 0.922 & 0.925 \\ \hline \end{tabular}
\end{table} 
Table 5: Performance metrics of the multiclass class scenario based on ALL features. To demonstrate the feasibility of the proposed method, confusion matrixes for all used classifiers are presented for binary and multiclass classification in Figure 12a,b, respectively. Providing insight into the feasibility of each classifier and how it performs accurately and correctly identifies TP, TN, FP, and FN through the features selected for it by the proposed method. The classes in binary classification are (Doh-benign, Doh-malicious) while the tuples in multiclass classification are (Doh-benign, Doh-malicious and Non-Doh). Figure 11: Comparison of (XgBoost, KNN, RF, and CNNs) classification accuracy for multiclass with All Features vs. Selected Features-based ACO. Figure 10: Comparison of (XgBoost, KNN, RF, and CNNs) classification accuracy for Binary class with All Features vs. Selected Features-based ACO. Figure 12: Confusion matrices of (XgBoost, KNN, RF, and CNNs) classifiers for both (**a**) binary class task and (**b**) multiclass task for selected features-based ACO. Related to binary class, XGBoost demonstrated superior discriminative capability, achieving 74,846 TN for Doh-benign and 74,969 TP for Doh-malicious, with minimal misclassifications (10 FP and 3 FN)]. RF exhibited comparable robustness, yielding 74,854 TN and 74,964 TP, though slightly higher (FN 8) relative to XGBoost. In contrast, KNN showed reduced precision, misclassifying 34 benign instances as malicious FP and 193 malicious instances as benign FN, resulting in lower TP 74,779 and TN 74,822. CNNs, despite their computational complexity, underperformed significantly, with 52 FP and 223 FN, reflecting challenges in generalizing to minority-class detection (74,751 TP and 74,802 TN). These results underscore the efficacy of ensemble methods (XGBoost, RF) for imbalanced DoH traffic classification while highlighting potential limitations of distance-based (KNN) and deep learning models (CNNs) in scenarios requiring high specificity for security-critical Doh-malicious detection. The elevated FN rates in CNNs, which are 0.3% of malicious cases, further emphasize the risks of relying on unoptimized architectures for cybersecurity applications, where false negatives pose critical operational threats. According to multiclass, XGBoost achieved robust discriminative performance, with high TP for all classes: 224,259 (Doh-benign), 225,620 (Doh-malicious), and 223,900 (Non-Doh). Its errors were minimal, primarily misclassifying 2023 Doh-benign instances as Non-Doh and 2316 Non-Doh samples as Doh-benign, while maintaining near-perfect precision for Doh-malicious (52 misclassified as benign, 21 as Non-Doh). RF outperformed all models in Doh-malicious detection 225,582 TP, with exceptionally low cross-class errors (e.g., only 3 Non-Doh misclassified as malicious) and strong Non-Doh recognition 224,228 TP. In contrast, KNN exhibited pronounced instability, particularly in distinguishing Non-Doh traffic: 4853 Non-Doh samples were misclassified as Doh-benign, and 2593 as Doh-malicious, while its Doh-malicious TP 225,097 lagged behind ensemble methods. CNNs mirrored KNN's limitations, with severe Non-Doh misclassifications (4868 Doh-benign and 2633 Doh-malicious) and elevated Doh-malicious errors (443 misclassified as Non-Doh), underscoring challenges in hierarchical feature learning for minority classes. Notably, Doh-benign and Non-Doh confusion dominated error patterns across models, suggesting overlapping feature representations in non-malicious traffic. However, Doh-malicious detection remained highly reliable for XGBoost and RF (FN < 0.1%), critical for security applications where false negatives carry severe risks.