# Enhancing Botnet Detection in Network Security Using Profile Hidden Markov Models
## 5 Results  
The solution proposed was implemented using two models: Hidden Markov Model (HMM) and Profile Hidden Markov Model (PHMM). For the HMM, the Python library 'hmmlearn' was utilized, while the PHMM implementation made use of the HMMER tool. The performance of these models was evaluated using various metrics such as training and testing accuracies, precision, recall, and F1 score. The results of these evaluations are presented in Tables 7-9. Table 7 presents the model evaluation for \(N=8\). The highest accuracy was achieved for Donbot, followed by Neris. This could be attributed to the larger number of botnet data samples present in the dataset. The lowest accuracy was observed for the detection of normal traffic. Figure 10 displays the confusion matrix for multiclass classification for HMM. The test data consisted of 835 normal traffic samples and 837 botnet samples. Although the botnets were classified effectively, the classification of normal traffic was not as successful. This could be due to the greater diversity and variability in normal network traffic, which is influenced by factors such as different protocols or user behavior. In contrast, botnet traffic tended to exhibit similar patterns. Table 8 presents the model evaluation for \(N=2\), and Figure 10c shows the corresponding confusion matrix. For the PHMM implementation, the normalized data were binned to correspond with uppercase English alphabetical characters, using a total of 25 bins to match the first 25 lettersof the alphabet. Bin edges were defined for each column in the dataset. The training and testing datasets were then binned.Then, the data in the binned columns were concatenated to form the sequences. These sequences were converted to the FASTA format required for HMMER input, with each sequence assigned a unique sequence number, like 'Seq', added as the header line for each sequence. These sequences were inputted into HMMER, with true labels stored in separate files for train and test sequences. The output from HMMER resulted in a text file. This text file was parsed to store the data in Python dataframes. The score from the result file, which represents the likelihood of the sequence belonging to the class, was used to determine the classes. The test sequences were inputted for all seven PHMMs, and the scores were compared to determine the probable class with the maximum score values. Sequences that did not generate a match for any of the seven PHMMs trained for seven botnets were classified as normal. These predicted labels were compared against true labels to evaluate the model. Table 9 presents the results obtained for the PHMM. The highest accuracy was observed for NSIS.ay, and the lowest was for normal network traffic. As with the HMM, this might be due to the greater diversity and variability in normal network traffic. Figure 10b displays the confusion matrix for multiclass classification for the PHMM. The test data consisted of 2231 normal traffic sequences and 2852 botnet samples. From Table 10, we can observe the average accuracies for training and testing data for both the HMM and PHMM. The PHMM performed better in terms of accuracy. Also, from Table 9, we can see that the accuracy for classifying normal traffic was better in the case of the PHMM. This could be due to the complexity of the PHMM model compared to the HMM, enabling it to perform better. It can be seen that accuracies are almost the same. However, from Table 11, we can see that the F1 score for HMM is lower than PHMM. This is because the precision of the HMM is lower than that of the PHMM, as normal traffic was misclassified as botnet traffic since normal network traffic has more diversity and variability than botnet traffic.