# Enhanced Peer-to-Peer Botnet Detection Using Differential Evolution for Optimized Feature Selection
## 5 Results
\begin{table}
\begin{tabular}{l c c c c c c c c c c c c c} \hline \hline  & & & & & & & & & & & & & & & \\ \hline
**Model** & 2 & 3 & 4 & 5 & 6 & 7 & 8 & 9 & 10 & 11 & 12 & 13 & 14 \\ LDA & 0 & 0 & 0.51 & 0.99 & 0.99 & 2.41 & 4.17 & 4.17 & 9.09 & 6.42 & 5.57 & 5.56 & 5.56 \\ KNN & 97.31 & 97.08 & 94.77 & 94.77 & 90.60 & 91.12 & 91.11 & 91.22 & 87.45 & 87.45 & 87.37 & 87.37 & 87.37 \\ DT & 98.12 & 97.98 & 98.02 & 97.88 & 97.83 & 97.61 & 97.70 & 97.83 & 97.43 & 97.39 & 97.26 & 97.03 & 97.39 \\ RF & 99.53 & 99.30 & 99.58 & 99.58 & 99.67 & 99.67 & 99.76 & 99.81 & 99.81 & 99.76 & 99.86 & 99.76 & 99.81 \\ NB & 0 & 0 & 2.90 & 4.05 & 4.07 & 3.61 & 3.61 & 1.16 & 1.34 & 1.37 & 1.38 & 1.38 & 1.38 \\ SVM & 0 & 0 & 79.27 & 78.89 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ MV & 99.49 & 99.30 & 99.62 & 99.56 & 99.52 & 99.56 & 99.57 & 99.57 & 99.34 & 99.48 & 99.33 & 99.33 & 99.38 \\ \hline \hline \end{tabular}
\end{table} 
Table 20: Precision matrix of the model using all feature subsets. \begin{table}
\begin{tabular}{l c c c c c c c c c c c c c} \hline \hline  & & & & & & & & & & & & & & \\ \hline
The following table (Table 21) demonstrates the recall matrix of the model using all of the feature subsets. Figure 4: Graph showing precision vs. number of features for different models for peer-to-peer botnet detection system. \begin{table}
\begin{tabular}{l c c c c c c c c c c c c c} \hline \hline  & & & & & & & & & & & & & & & \\ \hline
**Model** & 2 & 3 & 4 & 5 & 6 & 7 & 8 & 9 & 10 & 11 & 12 & 13 & 14 \\ LDA & 0 & 0 & 0.05 & 0.32 & 0.32 & 0.05 & 0.09 & 0.09 & 0.60 & 0.97 & 0.74 & 0.74 & 0.74 \\ KNN & 99.30 & 98.70 & 95.82 & 95.82 & 91.32 & 90.95 & 90.95 & 91.18 & 88.30 & 88.30 & 88.02 & 88.02 \\ DT & 99.30 & 99.21 & 98.80 & 98.79 & 98.48 & 98.51 & 98.47 & 98.33 & 98.56 & 98.56 & 98.70 & 98.70 \\ RF & 99.30 & 99.21 & 98.98 & 98.65 & 98.65 & 98.19 & 97.68 & 98.24 & 97.96 & 98.14 & 97.63 & 97.63 & 97.73 \\ NB & 0 & 0 & 23.54 & 32.73 & 72.28 & 72.56 & 72.56 & 99.03 & 99.07 & 99.12 & 99.07 & 99.07 & 99.07 \\ SVM & 0 & 0 & 54.69 & 54.83 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 \\ \hline MV & 98.98 & 98.60 & 96.80 & 96.80 & 96.15 & 95.54 & 95.68 & 96.84 & 96.84 & 96.80 & 96.56 & 96.43 & 96.61 \\ \hline \hline \end{tabular}
\end{table} 
Table 21: Recall matrix of the model using all feature subsets for peer-to-peer botnet detection. Figure 3: Graph showing the accuracy of the six classification algorithms and majority voting ensemble learning algorithm. Figure 5 shows the recall vs. number of features for different models for a peer-to-peer botnet detection system. The following table (Table 22) demonstrates the F1-score matrix of the model using all of the feature subsets. The figures above (Figures 3-6) illustrate the performance of six classification algorithms (NB, KNN, DT, LDA, RF, and SVM) and the ensemble learning algorithm (mv) across all of the feature subsets. In order to enhance the performance of the proposed method, we employed the majority voting algorithm. This involved taking the results obtained from the base classifiers mentioned earlier (as detailed in Table 18) and utilizing them as input for the majority voting algorithm. The output of this ensemble approach, depicted in Table 18, represents the final result of our methodology. Our method attained an accuracy of 99.99% (Table 23), indicating that the overall predictions made by the classification model are highly accurate. While accuracy is crucial, especially in balanced datasets, it may not fully represent model performance in imbalanced class distributions. Therefore, we also evaluated our model using precision, recall, and F1-score metrics and we generated a confusion matrix as well. Our method achieved a precision of 99.49%, ensuring that a large proportion of instances predicted as positive are indeed relevant. With a recall value of 98.98%, our model effectively minimizes false negatives, correctly identifying a significant portion of positive instances. Furthermore, the