# Enhanced Peer-to-Peer Botnet Detection Using Differential Evolution for Optimized Feature Selection
## 3 Proposed Approach
### Differential Evolution  
Differential evolution (DE) is a metaheuristic algorithm used for solving various optimization problems where the objective function may be nonlinear, non-differentiable, or noisy. Feature selection is a combinatorial optimization problem. DE is a metaheuristic algorithm based on populations, designed to locate the global minimum of a multivariate function. This evolutionary computing algorithm initiates with an initial set of candidate solutions and systematically updates them through iterations [27]. DE is applied to multidimensional real-valued functions without relying on the gradient of the optimization problem. This lack of dependence on gradients distinguishes DE from classical optimization methods like gradient descent and quasi-Newton methods, which necessitate differentiability. Consequently, DE is suitable for optimization problems that are non-differentiable, non-continuous, noisy, subject to changes over time, and various other challenging scenarios [27]. DE is a stochastic direct search method that explores the solution space without relying on derivative information, making it well suited for optimization tasks [28]. It draws inspiration from [PERSON]'s theory of evolution and natural selection. Demonstrating its effectiveness across diverse domains, the DE algorithm orchestrates the evolution of a population of candidate solutions through iterative processes of mutation, crossover, and selection. This ongoing evolution, transitioning from one generation to the next, guarantees that individuals with superior qualities persist within the population, while weaker ones are systematically phased out in each iteration [29]. Based on the reviews [28; 29; 30; 31; 32], the advantages of DE for feature selection are described below:* DE is simple, straightforward, and easy to implement compared to other evolutionary algorithms. * Despite its simplicity, DE exhibits a better performance. * The number of control parameters in DE is much lower. * DE is known for its fast convergence and efficient exploitation of the search space. * DE can be used for nonlinear and non-differentiable optimization problems. The workings of the DE algorithm are depicted by the following flow chart (Figure 2) and Algorithm 1. DE has three basic operators: mutation, crossover, and selection. Mutation: DE generates new candidate solutions by perturbing the existing population. This is typically achieved by selecting three distinct individuals (parents) from the current population and combining them to create a new solution (offspring). During this process, an offspring or mutant vector is generated for every target vector using the following Equation (1):  
\[\mathrm{V_{i,g+1}}=\mathrm{X_{r1,g}}+\mathrm{F}*\left(\mathrm{X_{r2,g}}- \mathrm{X_{r3,g}}\right) \tag{1}\]  
where g represents the generation or iteration, \(V_{i}\) is the new solution vector or mutant vector (i = 1, 2, 3,..., NP), and r1, r2, and r3 are three distinct individuals selected randomly from  
Figure 2: Flow chart of differential evolution for peer-to-peer botnet detection system. the population such that r1, r2, r3 e [1, NP] and r1 \(\
eq\) r2 \(\
eq\) r3 \(\
eq\) i. NP is the population size. F is a user-defined scaling factor or mutation parameter that amplifies the difference vector and lies within [0, 1]. This process of generating a new individual is known as mutation. Crossover: In order to enhance the diversity of the perturbed population, a crossover or recombination operator is used. During this phase, a crossover operator is applied between the parent vector or target vector \(X_{i}\) and the corresponding mutant vector \(V_{i}\) to generate a trial vector \(W_{ij}\) as in the following Equation (2):  
\[W_{\bar{\mathrm{ij}}}= \begin{cases}V_{\bar{\mathrm{ij}}}&\text{ if (rand $\leq$ CR) or j =$\mathrm{jr}$ and}\\ &X_{\bar{\mathrm{ij}}}&\text{ otherwise}\end{cases}