# DNS over HTTPS Tunneling Detection System Based on Selected Features via Ant Colony Optimization
## 4 Experimental Results and Discussion
### Computational Time and Complexity Reduction  
In addition to improving classification performance, it is essential to evaluate the computational efficiency of the proposed feature selection method, particularly in terms of execution time and complexity. The execution time required by each classifier to process all features of the dataset was measured and compared with the time taken to classify the dataset using only the features selected by the proposed methods for both binary classification (Table 9) and multiclass classification (Table 10). This comparison provides a comprehensive assessment of the computational complexity involved in the decision-making process across different scenarios. By analyzing the classification times and calculating the reduction rate (as defined in Equation (11)) for both full and reduced feature sets, the results demonstrate that the proposed method significantly reduces execution time and overall computational complexity for all classifiers, as illustrated in Figures 13 and 14. \[\text{Time Reduction }\%=\left(\frac{\text{All Features Time }-\text{Selected Features based ACO Time}}{\text{All Features Time}}\right)*100 \tag{11}\]  
Figure 13: Execution time of (XgBoost, KNN, RF, and CNNs) classifiers for binary class with All Features vs. Selected Features-based ACO. \begin{table}
\begin{tabular}{c c c} \hline
**Classifiers** & **Binary Class Accuracy** & **Multiclass Accuracy** \\ \hline XGBoost & 0.997 & 0.991 \\ \hline KNN & 0.999 & 0.984 \\ \hline RF & 0.999 & 0.995 \\ \hline CNNs & 0.998 & 0.985 \\ \hline \end{tabular}
\end{table} 
Table 8: Performance classifiers in both classification scenarios using real live traffic based on ACO-selected features. The proposed method significantly contributed to reducing the less important features, which in turn contributed to reducing the computational complexity of the classifiers used in binary and multiclass classification. Table 11 summarizes the effect of selecting the most important features for reducing the computational complexity before and after feature selection for KNN, XGBoost, RF, and CNNs. \begin{table}
\begin{tabular}{c c c c} \hline
**Classifiers** & **All Features (Seconds)** & **Selected Features—ACO (Seconds)** & **Time Reduction \%** \\ \hline XgBoost & 210.92 & 155.76 & 26.15\% \\ \hline KNN & 185.49 & 133.57 & 27.99\% \\ \hline RF & 230.73 & 163.43 & 29.16\% \\ \hline CNNs & 290.86 & 189.27 & 34.93\% \\ \hline \end{tabular}
\end{table} 
Table 10: Execution Time Computation comparison for multiclass with and without feature selection-based ACO. Figure 14: Execution time of (XgBoost, KNN, RF, and CNN) classifiers for multiclass with All Features vs. Selected Features-based ACO. \begin{table}
\begin{tabular}{c c c c} \hline
**Classifiers** & **All Features (Seconds)** & **Selected Features—ACO (Seconds)** & **Time Reduction \%** \\ \hline XgBoost & 130.46 & 95.31 & 26.94\% \\ \hline KNN & 108.75 & 76.49 & 29.66\% \\ \hline RF & 160.32 & 110.66 & 30.97\% \\ \hline CNNs & 179.87 & 118.39 & 34.19\% \\ \hline \end{tabular}
\end{table} 
Table 9: Execution Time Computation comparison for binary class with and without feature selection-based ACO. As practical challenges, Deploying machine learning-based solutions within IDSs in real-world environments introduces critical challenges, particularly concerning scalability and latency. As traffic volumes grow, IDSs must maintain efficient processing without compromising real-time detection capabilities. In the specific context of DoH, these challenges become even more pronounced due to the encryption, decryption, and high variability of traffic patterns. Furthermore, preprocessing overhead significantly affects latency, as features often differ in format and require various data preprocessing before classification. This added computational cost can delay real-time decision making and impact overall system responsiveness.