Input: train_data a labeled training set, test_data a labeled testing set
Output: PF a list of promising features
(1) an error range, the botnet traffic detection rate,
the current botnet traffic detection rate
(2) initialization ,
(3) = Randonforest (all features)
(4) while    do
(5) 
(6) calculate RF scores of importance
(7) rank the RF scores
(8) delete the feature with the smallest importance from train_data and test_data
(9) = randomforest (remaining_features)
(10) end while
Algorithm 2: Feature selection algorithm.