## 3 Materials and Methods
### Pre-Processing
In this process, the addition of KNN improves the efficiency of GA. This is because it can artificially enhance the composition of the population by selecting new members that are closer to quality individuals as much as possible. The pseudocode of GA is as Algorithm 1. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Feature Type** & **Description** & **Accuracy** & **Training Time** \\ \hline Strongly Relevant & It is necessary for an optimal feature subset. & High & Low \\ Irrelevant & It cannot help discriminate between supervised or unsupervised data. & Low & High \\ Redundant & It can be completely replaced with a set of other features. & Low & High \\ Noisy & It is not relevant to the learning or mining task. & Low & High \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Different feature components during feature selection. GA simulates natural selection and inheritance. Continuous random selection, crossover, and mutation operations generate individuals better suited to the environment, converging into the fittest individuals. This approach yields quality solutions to problems. The 41 chromosome features are converted into binary code for machine learning algorithms. Each individual's genotype consists of 41 genes. In GA chromosome coding, binary strings (1 s and 0 s) represent selected and non-selected feature subsets. Random binary bit assignment ensures population diversity. For functional selection, the proposed enhancement of GA in feature selection starts with the training data as the input and then generates the feature chromosomes. Each chromosome will be evaluated. The chromosome with the highest classification accuracy will be selected and considered as the optimized feature chromosome. The next step is to use the optimized feature chromosomes from the training data to train the KNN (K-Nearest Neighbor). The KNN algorithm is a basic classification and regression algorithm--a method in supervised learning. Given a training set M and a test object n, where the object is a vector with an attribute value and unknown category label. The distance (typically Euclidean distance) or similarity (typically cosine similarity) between object m and each object in the training set is calculated. The nearest neighbors are identified, and the top K categories with the highest frequency among them are assigned to the test object z. This classifier helps identify network activity classes as normal or abnormal using the calculated accuracy. On the other hand, test data are used to evaluate the performance of the classifier to check whether the trained algorithm is able to generalize new information based on the evaluation results encountered from the training data. This process will improve the new generation of chromosomes without sacrificing population diversity. The selection operation ensures that the best chromosomes representing the best solution will be selected as parents to produce better-performing offspring for the next generation. This study used tournament selection. After selecting the best-performing chromosomes, crossover operations were applied to produce new progeny, resulting in better chromosomes. This is performed by mixing the parents' genes using crossover probabilities (Pc). This study applied a single-point crossover. The mutation is performed with random bit-flip mutations in individual chromosomes, where substrings are randomly selected and flipped using the mutation probability (Pm). Specifically, we randomly selected and reversed a contiguous segment of a selected individual's genes. Here, we used 30 iterations, a crossover rate (Pc) of 0.7, and a variation rate (Pm) of 1/41, i.e., 0.02. The algorithm described above was designed to efficiently select features with the highest accuracy scores in the training data.