# Enhanced Peer-to-Peer Botnet Detection Using Differential Evolution for Optimized Feature Selection
## 4 Experiments
### Parameter Tuning
#### 4.2.1 Parameter Tuning of Differential Evolution Algorithm  
DE is an evolutionary metaheuristic optimization algorithm, with multiple parameters that influence its performance. The selection of these parameters plays a crucial role in determining the algorithm's efficiency and convergence speed. These parameters can be optimized using methodologies such as grid search, random search, or by using some advanced optimization techniques to discover values that effectively address the specifics of the optimization problem at hand. Python (version 3.12) offers a range of libraries \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Scenario**} & **Duration** & **Number of** & \multicolumn{2}{c}{**Number of**} & \multirow{2}{*}{**Size (GB)**} & \multirow{2}{*}{**Bot Family**} & **Number of Bot** \\  & **(hrs)** & **Packets** & & & & \\  & & & & & & \\  & & & & & & \\ \hline
12 & 1.21 & 13,212,268 & 1,262,790 & 8.3 & NSIS.ay & 3 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Network traffic details of Scenario 12 of CTU-13 dataset. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Number** & **Feature Name** & \multicolumn{2}{c}{**Description**} \\ \hline F1 & StartTime &
\begin{tabular}{c} Date of the flow start (from 2011/08/10 10:02:43 to \\ 2011/08/19 11:45:43) \\ \end{tabular} \\ F2 & Dur & Duration of the communication in seconds \\ F3 & Proto & Transport protocol used \\ F4 & SrcAddr & IP address of the source \\ F5 & Sport & Source port \\ F6 & Dir & Direction of the flow \\ F7 & DstAddr & IP address of the destination \\ F8 & Dport & Destination port \\ F9 & State & Transaction state \\ F10 & sTos & Source TOS byte value \\ F11 & dTos & Destination TOS byte value \\ F12 & TotPkts & Total number of transaction packets \\ F13 & TotBytes & Total number of transaction bytes \\ F14 & SrcBytes & Total number of transaction bytes from the source \\ F15 & Label/target & Label made of “flow=” followed by a short description \\  & & & (source/destination-malware/application) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Feature descriptions of Scenario 12 of the CTU-13 dataset. for implementing evolutionary algorithms such as SciPy, DEAP, etc. In our experiments, we have used python's DEAP (Distributed Evolutionary Algorithms in Python) library. DEAP is a multi-purpose library for evolution strategies, and it has a number of modules adapted to various kinds of evolutionary strategies including DE. This library offers a high degree of customization and flexibility, making it a preferred choice if we wish to tailor our evolutionary algorithms to specific needs or experiment with different aspects of the algorithm's behavior [40]. DEAP is a powerful library for building custom evolutionary strategies for specific purposes. In our studies, however, the DE parameters [41] that were used according to DEAP's Simple function are as follows: \"ngen\", \"popsize\", \"cxpb\", and \"mutpb\". Number of generations (\"ngen\") is a controlling factor used to determine how many generations or iterations to carry out within the algorithm. Population size (\"popsize\") is a controlling factor used to control the number of the candidate solutions that are maintained in each generation. Crossover probability (\"cxpb\") is a control parameter that determines the likelihood of performing crossover (recombination) operations on the individuals in the population. Mutation probability (\"mutpb\") is also a control parameter that governs the chances of mutations happening in individual candidate solutions within the population. In order to find the best value for these parameters, we have experimented with a random search algorithm. We have taken 10 values (V1 to V10) for each parameter as shown in Table 4.  
To make a selection for the most optimal values of the DE parameters, a random search algorithm was run 50 times. Table 5 shows the fluctuations of \"ngen\" selected values during 50 runs. Table 5 reveals that V8 (90) is the value that was mostly selected for the parameter \"ngen\".