# DNS over HTTPS Tunneling Detection System Based on Selected Features via Ant Colony Optimization
## 2 Literature Review
Moreover, they have several limitations, including efficiency in computation and convergence speed. In paper [20], metaheuristic optimization algorithms were used to optimize features in the CIRA-CIC-DoHBrw-2020 dataset via PSO, ABC, and K-means. Additionally, hybrid models have been proposed in which K-means is used with PSO and ABC for the clustering process. This study reported a 99.5% accuracy and 99.4% precision high performance. The analysis limited itself to a binary classification, separating them only as DoH traffic or non-DoH traffic. The researchers in [22] proposed a refined variation of the EO algorithm called Levy-opposition equilibrium optimization (LOEO) to increase functional selection in network intrusion detection systems (NIDSs). The opposition-based learning (OBL) technique is integrated with the proposed algorithm to improve the diversity of candidate solutions, and the Levy flight mechanism is applied to flee the local optima. LOEO showed consistently high detection performance, exceeding 95% on benchmark datasets (e.g., NSL-KDD, UNSW-NB15, and CIC-IDS2017) on a combination of select best features. For example, on the UNSW-NB15 dataset, LOEO chooses an average of only 10.8 features, achieving a high accuracy of 97.6%. Furthermore, the GA combined with the SVM and KNN classifiers yielded an average accuracy of 98.94% in the study presented in paper [21], which used the effective features in the dataset, encompassing both benign DoH and malicious DoH traffic, and it was shown that the method can accurately classify the type of network traffic. The study did not specify features selected by the GA and used in the classifiers. Reviewing existing literature reveals several limitations, particularly in studies using metaheuristic algorithms for feature selection. While the reviewed studies focus on binary or multiclass classification, they often suffer from unclear data preprocessing methods, high computational complexity, and long training times. Additionally, these approaches typically do not apply their models to both classification tasks, limiting their versatility and broader applicability. Detection accuracies are frequently suboptimal, reducing the practical effectiveness of these methods. These identified gaps emphasize the need for more comprehensive, efficient, and accurate solutions, especially for metaheuristic-based feature selection techniques. In this work, an ACO approach is proposed for extracting the most informative features from the CIRA-CIC-DoHBrw-2020 dataset. This method is evaluated with four ML algorithms: XGBoost, KNN, RF and CNNs. Furthermore, by implementing a clearly defined and transparent data preprocessing stage, this method also includes balancing the dataset so that it adequately represents each class, which leads to better performance than in previous works. This study performs experiments for both binary classification (classifying benign DoH and malicious DoH traffic) and multiclass classification (distinguishing nonDoH, benign DoH, and malicious DoH). This iterative methodology not only enhances feature selection but also reduces time complexity and fortifies the model against overfitting, establishing overall adaptability across various classification tasks.