| Input: train_data a labeled training set, test_data a labeled testing set |
| Output: PF a list of promising features |
| (1) an error range, the botnet traffic detection rate, |
| the current botnet traffic detection rate |
| (2) initialization , |
| (3) = Randonforest (all features) |
| (4) while do |
| (5) |
| (6) calculate RF scores of importance |
| (7) rank the RF scores |
| (8) delete the feature with the smallest importance from train_data and test_data |
| (9) = randomforest (remaining_features) |
| (10) end while |