# Detecting Malware C&C Communication Traffic Using Artificial Intelligence Techniques
## 4 Research Methodology
### Feature Selection
A subset of these features is evaluated further, and this is based on the average correlations with the target variable and the inverse of the correlation between the features themselves. The formula for calculating the CFS is shown in Equation (2) [82]. \(S\) is the subset of selected features, \(r_{cf}\) is the correlation between the selected features and the target variable, \(r_{ff}\) is the correlation between the features themselves, \(k\) is the number of features in the subset \(S\), and \(m\) is the total number of features in the dataset. \[CFS(S)=\frac{r_{cf}}{\sqrt{r_{ff}+\frac{k(k-1)}{m}}} \tag{2}\]  
The features with the highest combined score are selected. Figure 11 shows the feature ranking scores calculated by CFS. ANOVA is another feature selection approach that was used during this research. In ANOVA, the data are split into groups, and these groups represent the different categories being compared. The groups are compared to the target variable, and the differences between these groups are calculated. Several calculations are performed by ANOVA, and these can be seen in Equation (3) [83]. The first is \(SSB\), which is the Sum of Squares Between groups, calculated as follows: \(k\) is the number of groups, \(n_{i}\) is the number of observations in group \(i\), \(\overline{x}_{i}\) is the mean of group \(i\), and \(\overline{x}\) is the overall mean. The second calculation is \(SSW\), which is the Sum of Squares within Groups and is calculated as follows: \(\overline{x}_{ij}\) is the value of the observation in group \(I\) and \(\overline{x}_{i}\) is the mean of group \(i\). The final calculation is \(F\)  
Figure 10: Feature rankings calculated by SelectKBest. which is the F-statistics, and in this formula, \(MSB\) is the Mean Square Between, \(MSW\) is the Mean Square Within, \(k\) is the number of groups, and \(N\) is the total number of observations. \[ \begin{array}{c}SSB=\sum\limits_{i=1}^{k}n_{i}(\overline{x}_{i}-\overline{x}) ^{2}\\ SSW=\sum\limits_{i=1}^{k}*\sum\limits_{j=1}^{n_{i}}(\overline{x}_{ij}-\overline{x }_{i})^{2}\\ f=\frac{MSB}{MSW}=\frac{SSB/(k-1)}{SSW/(N-k)}\end{array}  \tag{3}\]  
A large value suggests that the groups are different and can be considered as a suitable feature to use for the experimental work, and a small number suggests that the feature might not be suitable. Figure 12 illustrates the scores calculated by ANOVA, and the scores are ranked from the highest to the lowest. Figure 11: Feature rankings calculated by CFS. Figure 12: Feature rankings calculated by ANOVA. Several experiments were conducted using different features, and it was determined that the following ten features would be the most appropriate and minimum number of features required for predicting the different malware variants: mean_fpktl; min_fpktl; min_bpktl; min_fiat; mean_fiat; mean_fiat; min_biat; slow_fpackets; sflow_flyytes; and Duration. Increasing the number of features does not help to improve the prediction results and using a lower number of features reduces the efficiency of ML algorithms. The above ten features were used in the training and testing of the machine learning algorithms, and the results of the experimental analysis can be viewed in Section 5.