# Detecting Malware C&C Communication Traffic Using Artificial Intelligence Techniques
## 4 Research Methodology
### Feature Selection  
The statistical features were extracted and exported into a CSV file, and these were used as the features. A total of 44 features were extracted, however, not all the features were used. It is important to select the appropriate and best features, as this helps to reduce overfitting and computational cost and helps the ML algorithm to learn faster [75; 76]. Several approaches can be used to identify the appropriate features, and the three predominant approaches are the following [77]:  
* Filter method--Feature selection is independent of the ML algorithm. * Wrapper method--Features are selectively used to train the ML algorithm, and through continual experimental analysis, the best features are selected for the final model. This method can be very time-consuming. * Hybrid--A fusion of the filter and wrapper approaches. For this research, the features were analyzed using the filter-based approach, and three automated feature selection algorithms were used for this analysis, including the ANOVA [78], CFS [79], and SelectKBest [80] feature selection algorithms. SelectKBest is a feature selection approach which selects the top K features from all the features available. This is based on a scoring function based on how well each feature correlates with the target variable, and for this research, f_classif was used for the scoring mechanism, which scores each feature and then ranks these based on the score. The score assigned to the feature measures the relationship between the feature and the target variable, in this case, malware or benign, and then selects the top K features. The formula for calculating the f_classif is shown in Equation (1) [81]. K is the number of classes (distinct target labels), \(n_{i}\) is the number of samples in class \(i\), N is the total number of samples in the dataset, \(\overline{x}_{i}\) is the mean of feature values for class \(i\), \(\overline{x}\) is the overall mean of the feature across all samples, and \(x_{ij}\) is the value of the feature for sample \(j\) in class \(i\). \[F=\frac{\frac{1}{k}\sum_{i=1}^{k}n_{i}(\overline{x}_{i}-\overline{x})^{2}}{ \frac{1}{N-k}\sum_{i=1}^{k}\sum_{j=1}^{n_{i}}\left(x_{ij}-\overline{x}_{i} \right)^{2}} \tag{1}\]  
SelectKBest compares the mean values of different groups. The two groups considered are the 'between-group variances' and 'within-group variances'. A larger value assigned to a feature means that the feature is a good candidate for predicting the malware, whereas a smaller value means that the feature is unlikely to help predict the malware. The top \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Dataset Type** & \
\begin{tabular}{c} **Malware** \\ **Name/Year** \\ \end{tabular} & **Number of Flows** &
\begin{tabular}{c} **Name of Dataset for** \\ **This Paper** \\ \end{tabular} \\ \hline Malware & Zeus/2019 & 66,009 & Dataset1 \\ Benign & N/A & 66,009 & Dataset2 \\ \hline Malware & Zeus/2019 & 38,282 & Dataset2 \\ Benign & N/A & 38,282 & Dataset3 \\ \hline Malware & Zeus/2022 & 272,425 & Dataset3 \\ Benign & N/A & 272,425 & Dataset4 \\ \hline Malware & ZeusPanda/2022 & 11,864 & Dataset4 \\ Benign & N/A & 11,864 & Dataset5 \\ \hline Malware & Ramnit/2022 & 10,204 & Dataset5 \\ Benign & N/A & 10,204 & Dataset6 \\ \hline Malware & Dridex/2018 & 134,998 & Dataset6 \\ Benign & N/A & 134,998 & Dataset6 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Datasets used in this research. 10 features calculated by SelectKBest were selected for this research, and this was performed by setting the K Value to 10. This was based on experimental analysis, and increasing the K value further did not influence the prediction results. Figure 10 shows the feature rankings calculated using SelectKBest. CFS works by considering the correlation between each feature and the target variable and the correlations between the features themselves. CFS then selects the features that maximize and minimize the correlation between the features.