## 5 Experiments and Results
### Comparison Results  
In this subsection, the performance of the SSA-KELM is compared with the performance of a set of well-known classifiers; which are Naive Bayes (NB), Decision Tree C4.5 (J48), very powerful ensemble classifiers which are Random Forests (RF), AdaBoost, Bagging, and XGBoost. In addition, it is compared with another well-established swarm intelligence algorithm which is the particle swarm optimization (PSO). For which the inertia weight (\(w=[0.2,0.9]\)), the constraints (\(c1,c2\)) are set to value (2), and the maximum velocity is (6). The hyperparameters of XGBoost are optimized using a grid search algorithm, which determines a range of values (search space) for each hyperparameter. The grid search is used to optimize a five hyperparameters of XGBoost; which are the minimum-child-weight: [2; 5; 8], gamma: [0.1, 1, 1.5], number-of-estimators: [50; 120; 323], learning-rate: [0.3, 0.5, 0.9], and the maximum-depth: [6; 10; 15]. The XGBoost-Grid is evaluated based on 10-folds cross-validation, where the best results obtained at gamma = 0.1, min-child-weight = 2, number-of-estimators = 50, learning-rate = 0.9, and the maximum-depth = 6. Mainly, all classifiers evaluated using 10-folds cross-validation and implemented using Weka workbench [46]. The results of this comparison are shown in Table 7. The evaluation results show that the SSA-KELM outperforms all the other classifiers and swarm intelligence methods regarding the majority of the measures. Although some classifiers like Bagging and AdaBoosting showed very competitive results, they used the full set of features without any reduction like in the SSA-KELM. Moreover, the SSA-KELM outperformed the PSO-KELM in terms of all evaluation measures indicating its powerful capability. Therefore, the SSA-KELM has merits over conventional machine learning classifiers, where it exhibited efficacy in performance and in minimizing the selected subset of features. Feature importance analysis has a fundamental role in identifying to what extent the features play a part in the predictive power of the model. In this regard, the frequencies of selected subsets of \begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline
**Algorithm** & \multicolumn{6}{c}{**Evaluation Measures**} \\ \cline{2-9}  & **Accuracy** & **Recall** & **FPR** & **TNR** & **Precision** & **G-Mean** & **AUC** \\ \hline SSA-KELM & **0.980** & 0.980 & **0.020** & **0.980** & **0.980** & **0.980** & **0.980** \\ PSO-KELM & 0.972 & 0.978 & 0.034 & 0.966 & 0.967 & 0.972 & 0.972 \\ NB & 0.942 & 0.926 & 0.042 & 0.958 & 0.957 & 0.942 & 0.942 \\ J48 & 0.967 & 0.976 & 0.042 & 0.958 & 0.959 & 0.967 & 0.967 \\ RF & 0.974 & 0.984 & 0.036 & 0.964 & 0.965 & 0.974 & 0.974 \\ Adaboost & 0.972 & 0.976 & 0.032 & 0.968 & 0.968 & 0.972 & 0.972 \\ Bagging & 0.974 & **0.990** & 0.042 & 0.958 & 0.959 & 0.974 & 0.974 \\ XGBoost-Grid & 0.965 & 0.971 & 0.029 & 0.971 & 0.961 & 0.965 & 0.971 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Comparison of the performance of the SSA-KELM with conventional machine learning algorithms in terms of various evaluation metrics. features generated by the SSA algorithm were utilized to investigate the importance of features. In other words, as the SSA algorithm generates a new subset of features at each iteration; the frequency of the feature selection for all features is calculated over the number of iterations. Hence, the importance (FI) of a feature (i) is given by Equation (22), where \(L\) is the maximum number of iterations. \[FI(i)=\frac{\sum_{l=1}^{L}occurrences(i)}{L} \tag{22}\]  
Figure 12 presents the most important features of the API calls and permissions while training the SSA-KELM at the ratio of leaders (L=50%), and swarm size (P=50). In sub-figure (a), the plot shows the most and least occurred permissions features. In which, the most important features were reported when the importance \(>0.25\), while the least important, were reported when the importance \(<0.1\).