# Detecting Malware C&C Communication Traffic Using Artificial Intelligence Techniques
## 5 Results
### Comparing the Predication Results of all the Algorithms Tested  
The results obtained from testing all the algorithms are compared in this section. Figure 13 shows the malware recall results of all the algorithms when tested against all the datasets and Figure 14 shows the benign traffic recall scores. An expanded view of the results can be seen in Figures 15 and 16, which show both the recall and precision scores for both the malware and benign traffic samples. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Dataset Name** & \begin{tabular}{c} **Malware** \\ **Precision Score** \\ \end{tabular} & \begin{tabular}{c} **Malware** \\ **Recall Score** \\ \end{tabular} & \begin{tabular}{c} **Malware** \\ **F1-Score** \\ \end{tabular} & \begin{tabular}{c} **Benign** \\ **Precision Score** \\ \end{tabular} & \
\begin{tabular}{c} **Benign** \\ **Recall Score** \\ \end{tabular} &
\begin{tabular}{c} **Benign** \\ **F1-Score** \\ \end{tabular} \\ \hline Dataset 1 & 1.00 & 0.90 & 0.95 & 0.91 & 1.00 & 0.95 \\ Dataset 2 & 1.00 & 0.91 & 0.95 & 0.91 & 1.00 & 0.95 \\ Dataset 3 & 1.00 & 1.00 & 1.00 & 1.00 & 1.00 \\ Dataset 4 & 1.00 & 0.99 & 0.99 & 0.99 & 1.00 & 0.99 \\ Dataset 5 & 0.92 & 0.97 & 0.95 & 0.97 & 0.92 & 0.95 \\ Dataset 6 & 0.85 & 0.50 & 0.63 & 0.65 & 0.91 & 0.76 \\ \hline \hline \end{tabular}
\end{table} 
Table 16: Testing results when using the K-Nearest Neighbor (KNN) ML algorithm. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Dataset Name** & \begin{tabular}{c} **Malware** \\ **Precision Score** \\ \end{tabular}  & \begin{tabular}{c} **Malware** \\ **Recall Score** \\ \end{tabular}  & \begin{tabular}{c} **Benign** \\ **F1-Score** \\ \end{tabular}  & \begin{tabular}{c} **Benign** \\ **Precision Score** \\ \end{tabular}  & \ \begin{tabular}{c} **Benign** \\ **Recall Score** \\ \end{tabular}  & \begin{tabular}{c} **Benign** \\ **F1-Score** \\ \end{tabular}  \\ \hline Dataset 1 & 1.00 & 0.95 & 0.97 & 0.95 & 1.00 & 0.97 \\ Dataset 2 & 1.00 & 0.95 & 0.97 & 0.96 & 1.00 & 0.98 \\ Dataset 3 & 1.00 & 0.99 & 0.99 & 0.99 & 1.00 & 0.99 \\ Dataset 4 & 1.00 & 0.99 & 0.99 & 0.99 & 1.00 & 0.99 \\ Dataset 5 & 0.87 & 0.97 &Figure 14: Comparison of the prediction results for all three ML algorithms. Figure 13: Comparison of the prediction results for all three ML algorithms. Figure 15: Malware precision and recall scores. The results obtained during the testing phase indicate that the decision tree algorithm performed consistently well across all the datasets, with high accuracy scores for datasets 1-4. The performance for dataset 6 did decrease slightly, which seems to indicate that the decision tree algorithm faced some challenges when used for testing on a large dataset. Similar results were obtained for both the random forest and KNN algorithms. The results demonstrate that the random forest algorithm performed the best and is the most suited for this type of problem. All the results are compared in Figure 17, and the experimental results and the patterns observed suggest that the random forest and decision tree models were more robust and consistent across all the datasets, while the K-Nearest Neighbor and ensemble models may face some difficulties with larger or more complex data. Dataset 6 seems particularly challenging, reducing performance across all the datasets. This paper has demonstrated an approach that can be used to detect banking malware and some its variants, and has demonstrated that the methodology does work across multiple datasets and other variants of the Zeus malware. The research also allows key  
Figure 16: Benign precision and recall scores. Figure 17: Accuracy comparison across all the algorithms. inferences to be made, because one dataset was used for training and to create an ML model. This model was tested to evaluate its generalization and ability to classify other various banking malware variants. Metrics such as precision, recall, F1-score, and accuracy were used to assess the performance across these datasets.