# Enhanced Peer-to-Peer Botnet Detection Using Differential Evolution for Optimized Feature Selection
## 5 Results
The accuracy remains nearly unchanged, even as the number of features increases. 2. Precision is a key metric that measures the proportion of true positives out of all positive predictions. A feature set with two features gives the highest precision \begin{table}
\begin{tabular}{c c c c c c c c c c c c c} \hline \hline \multicolumn{10}{c}{**Count of Selected Features for Peer-to-Peer Botnet Detection System**} \\ \hline
**F1** & F2 & F3 & F4 & F5 & F6 & F7 & F8 & F9 & F10 & F11 & F12 & F13 & F14 \\ \hline
**4** & 2 & 7 & 18 & 11 & 4 & 9 & 3 & 3 & 2 & 2 & 10 & 6 & 4 \\ \hline \hline \end{tabular}
\end{table} 
Table 17: Count of selected features for peer-to-peer botnet detection system. \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline
**No. of Features** & **Accuracy** & **Precision** & **Recall** & **F1-Score** & **TP** & **TN** & **FP** & **FN** \\ \hline
2 & 99.99 & 99.49 & 98.98 & 99.23 & 2132 & 322,752 & 11 & 22 \\
3 & 99.99 & 99.30 & 98.60 & 98.95 & 2124 & 322,748 & 15 & 30 \\
4 & 99.98 & 99.62 & 96.80 & 98.19 & 2085 & 322,755 & 8 & 69 \\
5 & 99.98 & 99.56 & 96.80 & 98.16 & 2085 & 322,754 & 9 & 69 \\
6 & 99.97 & 99.52 & 96.15 & 97.80 & 2071 & 322,753 & 10 & 83 \\
7 & 99.97 & 99.56 & 95.54 & 97.51 & 2058 & 322,754 & 9 & 96 \\
8 & 99.97 & 99.57 & 95.68 & 97.59 & 2061 & 322,754 & 9 & 93 \\
9 & 99.98 & 99.57 & 96.84 & 98.19 & 2086 & 322,754 & 9 & 68 \\
10 & 99.98 & 99.34 & 96.84 & 98.1 & 2086 & 322,750 & 13 & 68 \\
11 & 99.98 & 99.48 & 96.80 & 98.12 & 2085 & 322,752 & 11 & 69 \\
12 & 99.97 & 99.33 & 96.56 & 97.93 & 2080 & 322,749 & 14 & 74 \\
13 & 99.97 & 99.33 & 96.43 & 97.86 & 2077 & 322,749 & 14 & 77 \\
14 & 99.97 & 99.38 & 96.61 & 97.98 & 2081 & 322,750 & 13 & 73 \\ \hline \hline \end{tabular}
\end{table} 
Table 18: Majority voting ensemble result using all feature subsets for peer-to-peer botnet detection. at 99.49, which decreases slightly as more features are included but generally remains high. * Recall measures how well the model identifies true positives out of all actual positives. The recall is highest with the two-feature set (98.98%) and tends to decrease as more features are added, bottoming out at 95.54% with seven features. * The F1-score balances precision and recall, and its values are high across all feature sets. The highest F1-score (99.23%) is observed with two features, which balances both precision and recall well. * The true positives are highest with feature sets ranging from 9 to 10 features (2086 TPs). * The false negatives (missed detections) are lowest when using two features (22 FNs), which is desirable as it indicates fewer missed detections of positive cases. * The false positives (incorrect positive classifications) are slightly higher with feature sets that have fewer features (such as 2 features with 11 FPs) but remain very close across most feature sets. Based on the F1-score (which balances precision and recall), two features appear to represent the optimal feature set, as this provides the highest F1-score (99.23%); the highest recall (98.98%), which means the model identifies more true positives; the highest precision (99.49%), reducing the number of false positives; and the lowest number of false negatives (22 FNs). Thus, using two features gives the best balance between precision and recall, making it the most efficient feature set for this task. The following table (Table 19) demonstrates the accuracy matrix of the model using all of the feature subsets. The below figures (Figures 3 and 4) display the accuracy and precision of the six classification algorithms and majority voting ensemble learning algorithm. The following table (Table 20) demonstrates the precision matrix of the model using all of the feature subsets.