A collaborative approach to early detection of IoT Botnet

Giang, Nguyễn Long; Dumba, Braulio; Ngo, Quoc-Dung; Le, Hai-Viet; Nguyen, Tu N.

doi:10.1016/j.compeleceng.2021.107525

Cited by 32 publications

(11 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It is possible to just use the subset of packets that fall inside a time window and calculate the desired features using them. As we already pointed out, some researchers looked for an optimal time window to detect botnet activity and settled on 180 s 35,37,39,40 . However, their research focused on attaining the best detection rate rather than spotting botnets in a small amount of time.…”

Section: Methodsmentioning

confidence: 99%

“…The experiments were carried out on the ISOT dataset with an ensemble model that combined k-means and DT, and the peak accuracy obtained was 99.4% , being relatively stable around this value if the time windows were inside the range between 150 and 300 seconds. In the same line, a recent work by Nguyen et al 40 proposed a collaborative detector that used features based on both network traffic and on computer processes, which also divided the activity on time windows. Their model also peaked in performance using time windows of 180 s.…”

Section: Figurementioning

confidence: 99%

See 1 more Smart Citation

Real-time botnet detection on large network bandwidths using machine learning

Velasco-Mata

González-Castro

Fidalgo

et al. 2023

Sci Rep

View full text Add to dashboard Cite

Botnets are one of the most harmful cyberthreats, that can perform many types of cyberattacks and cause billionaire losses to the global economy. Nowadays, vast amounts of network traffic are generated every second, hence manual analysis is impossible. To be effective, automatic botnet detection should be done as fast as possible, but carrying this out is difficult in large bandwidths. To handle this problem, we propose an approach that is capable of carrying out an ultra-fast network analysis (i.e. on windows of one second), without a significant loss in the F1-score. We compared our model with other three literature proposals, and achieved the best performance: an F1 score of 0.926 with a processing time of 0.007 ms per sample. We also assessed the robustness of our model on saturated networks and on large bandwidths. In particular, our model is capable of working on networks with a saturation of 10% of packet loss, and we estimated the number of CPU cores needed to analyze traffic on three bandwidth sizes. Our results suggest that using commercial-grade cores of 2.4 GHz, our approach would only need four cores for bandwidths of 100 Mbps and 1 Gbps, and 19 cores on 10 Gbps networks.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Figurementioning

confidence: 99%

Real-time botnet detection on large network bandwidths using machine learning

Velasco-Mata

González-Castro

Fidalgo

et al. 2023

Sci Rep

View full text Add to dashboard Cite

show abstract

“…However the main contrast between both [71], and ref. [72] is that Random Forest was considered within [72] approach which showed the highest accuracy, the accuracy further improves once the optimized model proposed by Nguyen et al [72] achieved "99.04" accuracy. Although since Random Forest is an ensemble variant for Decision Tree, the accuracy would justify the effectiveness of decision tree classifiers.…”

Section: Machine Learning Algorithms Comparisonsmentioning

confidence: 99%

“…The pattern that Tuan et al [71] identifies from the results table is that the higher the accuracy of the algorithms would mean that there would be more sensitivity present. Although, Nguyen et al [72] argued that Decision Tree classifiers are the most accurate from their prediction scores. However the main contrast between both [71], and ref.…”

Section: Machine Learning Algorithms Comparisonsmentioning

confidence: 99%

A Survey on Botnets, Issues, Threats, Methods, Detection and Prevention

Owen

Zarrin

Pour

2022

JCP

View full text Add to dashboard Cite

Botnets have become increasingly common and progressively dangerous to both business and domestic networks alike. Due to the Covid-19 pandemic, a large quantity of the population has been performing corporate activities from their homes. This leads to speculation that most computer users and employees working remotely do not have proper defences against botnets, resulting in botnet infection propagating to other devices connected to the target network. Consequently, not only did botnet infection occur within the target user’s machine but also neighbouring devices. The focus of this paper is to review and investigate current state of the art and research works for both methods of infection, such as how a botnet could penetrate a system or network directly or indirectly, and standard detection strategies that had been used in the past. Furthermore, we investigate the capabilities of Artificial Intelligence (AI) to create innovative approaches for botnet detection to enable making predictions as to whether there are botnets present within a network. The paper also discusses methods that threat-actors may be used to infect target devices with botnet code. Machine learning algorithms are examined to determine how they may be used to assist AI-based detection and what advantages and disadvantages they would have to compare the most suitable algorithm businesses could use. Finally, current botnet prevention and countermeasures are discussed to determine how botnets can be prevented from corporate and domestic networks and ensure that future attacks can be prevented.

show abstract

“…The Internet of Things network is exposed to all kinds of viruses and malware [3], and smart objects can be infected with all kinds of malware. Systems or objects infected with malware or botnets carry out malicious attacks against the network and disrupt network services [4]. DDoS attacks are an example of botnet attacks on the Internet of Things network and disrupt the provision of Internet of Things services.…”

Section: Introductionmentioning

confidence: 99%

Detection of attacks in the Internet of Things with the feature selection approach based on the whale optimization algorithm and learning by majority voting

Aliabadi¹,

Jalalian²

2023

Preprint

View full text Add to dashboard Cite

Penetration into the Internet of Things network is a challenge in the security of new-generation networks and smart cities. In most cases, malware is distributed in the Internet of Things and smart objects are infected by malware. Objects infected with malware or viruses, which are called botnets, perform attacks such as DDoS against network services. DDoS attacks make network services inaccessible to users. A suitable approach to detect attacks based on malware and botnet is to use intelligent and distributed intrusion detection systems in the Internet of Things and smart cities. In other research, a centralized architecture and deep learning and machine learning method have been used to design intrusion detection systems. Centralized approaches have limited ability to process large volumes of traffic and are vulnerable to DDoS attacks. In this paper, a distributed intrusion detection system is designed with two stages dimensionality reduction and classification. In the first stage, a new and improved version of the whale optimization algorithm(WOA) has been used to select features and reduce traffic dimensions in fog nodes. In the second stage, each fog node performs the classification of the important features of the network traffic by voting and combined learning. The fog nodes share the IP address of the attacking nodes with the detection of the attacking node. Experiments showed that the improved WOA algorithm has less error in calculating the optimal solution than the optimization algorithm of the WOA algorithm. Reducing the feature selection objective function in the proposed method shows that the WOA algorithm is finding optimal features for intrusion detection and reducing the intrusion detection error. The advantage of the proposed intrusion detection system is to deal with DDoS attacks and cooperation between fog nodes to share blacklists. Tests showed that the proposed method in detecting network intrusion without feature selection has accuracy, sensitivity, and precision of 98.21%, 98.09%, and 97.88%. The proposed method with feature selection has accuracy, sensitivity, and precision of 99.39%, 99.31%, and 99.28%. The accuracy and precision of the proposed method in network intrusion detection are higher than the gray wolf algorithm, genetics and support vector machine, the binary gray wolf algorithm, and the hybridized GWO and GA algorithm. The proposed method is more accurate in intrusion detection than the GWO + PSO and firefly algorithms.

show abstract

A collaborative approach to early detection of IoT Botnet

Cited by 32 publications

References 18 publications

Real-time botnet detection on large network bandwidths using machine learning

Real-time botnet detection on large network bandwidths using machine learning

A Survey on Botnets, Issues, Threats, Methods, Detection and Prevention

Detection of attacks in the Internet of Things with the feature selection approach based on the whale optimization algorithm and learning by majority voting

Contact Info

Product

Resources

About