# Detecting Malware C&C Communication Traffic Using Artificial Intelligence Techniques
## 2 Related Studies
The results depicted in both Tables 7 and 8 show good prediction results across all the datasets. The highest true positive rate was achieved when the algorithms were trained and tested using the features from the Softflowd set.1 and 2 feature set, and was obtained by both the C4.5 and SBB machine learning algorithms. The true positive scores obtained were 99% and 98%, respectively. Table 8 shows that the highest true positive rate achieved was 100%, and this was achieved by the SBB machine learning algorithm. Auto-mal is a product developed by [46] which analyzes binary codes and identifies a set of features that are used to identify malware such as the Zeus banking malware. These features are then used to automatically classify the malware samples into malware families, and this is performed by using several machine learning algorithms. These algorithms include the Support Vector Classification (SVM), logistic regression (RG), Classification Tree (CT), and K-Nearest Neighbor (KNN) machine learning algorithms. Auto-mal captures and categorizes network traffic by using information such as the IP address, port numbers, \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & \begin{tabular}{c} **Benign Samples** \\ **Used for Training** \\ \end{tabular} & \begin{tabular}{c} **Benign Samples** \\ **Used for Testing** \\ \end{tabular} & \
\begin{tabular}{c} **Malware Samples** \\ **Used for Training** \\ \end{tabular} &
\begin{tabular}{c} **Benign Samples** \\ **Used for Testing** \\ \end{tabular} \\ \hline Zeus-1 & 6099 & 6099 & 2614 & 2614 \\ \hline Zeus-2 & 611 & 611 & 262 & 262 \\ \hline Zeus (NETRESEC) & 252 & 252 & 108 & 108,100 \\ \hline Zeus (Snort) & 100 & 100 & 43 & 43 \\ \hline Conficker & 28,951 & 28,951 & 12,386 & 12,416 \\ \hline Torpig & 1864 & 1856 & 794 & 800 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Information about the datasets used by [45]. Figure 5: The two feature sets used by [45] during their experimental analysis. and protocol types, and during this experimental analysis, 1.980 Zeus malware samples were analyzed. The Zeus samples were split into two datasets, one of which was used for training and the other was used for testing. For testing, 979 samples of Zeus and 1000 normal samples were used, and the testing results showed that the SVM algorithm performed the best and was able to correctly identify 95% of the Zeus malware samples. The decision tree algorithm produced a high false negative result, and from this, ref. [46] concluded that the decision tree algorithm was limited in its usefulness. An XAI-driven antivirus software was developed by [47], which essentially uses Explainable Artificial Intelligence (XAI) to create AI models. This XAI-driven antivirus software was designed to identify the Citadel banking malware, which is a variant of the Zeus banking malware. Ref. [47] highlights the limitations of traditional antivirus programs and argues that an AI-driven approach is more robust, accurate, and proactive in detecting new and evolving malware variants of the Citadel banking malware. XAI uses multiple Extreme Learning Models (mELMs) to detect the Citadel banking malware, and mELM is a morphological technique used for digital image processing. Ref. [47] adopted this in their software program to detect Citadel and concluded that mELM is a viable technique that can be used to detect malware. The software achieved an accuracy of 98% and was also quick at training and learning. One of the key characteristics of XAI is that the authors provided some insights into how the algorithm works, and these insights can help other researchers in their research projects.