# Hierarchical Classification of Botnet Using Lightweight CNN
## 3 Materials and Method
### Proposed Approach  
Hierarchical classification (HC) has demonstrated remarkable effectiveness in handling datasets with inherent hierarchical structures, according to several studies [20; 21; 22; 23; 24; 25]. Their success can be attributed to their ability to capture information at different levels of granularity within the data. HC achieves this by employing a hierarchical architecture that mimics the hierarchical nature of the data itself. This allows them to learn informative features at each level of the hierarchy, ultimately leading to improved classification performance. Numerous investigations have highlighted the efficiency of employing CNN in the classification of tabular data [10; 11; 13]. In the present research, we introduce a lightweight CNN model tailored specifically for this purpose. As presented in the Section 3.1, the dataset at hand exhibits a hierarchical arrangement. Consequently, we put forth a novel approach employing a Hierarchical Convolutional Neural Network (HCNN). This architecture utilizes a common backbone depicted in Table 1, yet diverges into distinct models corresponding to each level within the hierarchical structure. This strategy enables a comprehensive exploration of the HCNN's impact by comparing the performance across different hierarchy levels. The hierarchical feature learning process in CNNs allows the network to generalize well to new, unseen data. The learned hierarchical representations can capture essential characteristics of the input data, leading to better generalization performance on diverse datasets. While the initial level of the HCNN might not yield a substantial alteration in classification performance, its impact becomes notably evident in the final level. This study introduces two models: a non-hierarchical model, illustrated in Figure 4, and a hierarchical model, illustrated in Figure 5. The non-hierarchical models incorporate a backbone as shown in Table 1, along with their respective final dense layer for classification employing a softmax Activation Function. The hierarchical model utilizes the same backbone but incorporates a hierarchical structure at each level of the hierarchy. The primary structure of the backbone model includes Conv1D, MaxPooling, Conv1D, and Global Average Pooling (GAP). The adoption of Global Average Pooling (GAP) in place of the flattened layer has resulted in a decrease in the overall parameter count. The total parameters in the backbone model sum up to 848, reflecting a notably compact size. For the three non-hierarchical models, the parameter counts are 882 for the first model Figure 4a, 933 for the second model Figure 4b, and 1035 for the final model Figure 4c. The HCNN model outlined in Figure 5 comprises two components: the backbone, the same as that of the non-hierarchical models, and the hierarchical network. The hierarchical network operates by combining the features acquired at a higher level with those of its ancestor. This combined information is then provided as input to the subsequent layer to acquire features for the descendant nodes. The network comprises 1790 parameters, with the hierarchical network introducing 942 parameters to the backbone. The backbone network produces a root representation \(R_{0}\), which is given by the function in Equation (1) which is the global average pooling of the final convolutional layer of the backbone network, where X is the input features and \(\theta_{0}\) is the parameters of the network. \[R_{0}=GAP(F(X,\theta_{0})) \tag{1}\] \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Algorithm** & **Layers** & **Output Shape** & **Kernel** & **AF** \\ \hline CNN-GAP Backbone & Conv Layer & (26, 16) & (3, 3) & tanh \\  & MaxPooling & (13, 16) & (2, 2) & - \\  & Conv Layer & (13, 16) & (3, 3) & tanh \\  & GAP Layer & (1, 16) & - & - \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Base model architecture [AF = Activation Function].