An efficient reinforcement learning-based Botnet detection approach

Alauthman, Mohammad; Aslam, Nauman; Alkasassbeh, Mouhammd; Khan, Suleman; Al-Qerem, Ahmad; Choo, Kim‐Kwang Raymond

doi:10.1016/j.jnca.2019.102479

Cited by 102 publications

(54 citation statements)

References 67 publications

(81 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…( 6), (2), ( 5), (1) respectively. Diagrams ( 5)- (7) in this Fig, show the detection of the bot using the benchmark A and benchmark B. In the diagrams ( 5)-( 7), for different time intervals of the dataset, we showed the existence and non-existence of the bot by 1 and 0, respectively.…”

Section: Results Of the Implementation Of The First And Second Benchmarksmentioning

confidence: 85%

See 1 more Smart Citation

A Novel Approach of Botnets Detection Based on Analyzing Dynamical Network Traffic Behavior

2021

View full text Add to dashboard Cite

Nowadays, Botnets have become one of the most serious cybersecurity threats and cyber crimes such as DDoS, spam, identity theft, and phishing. Because of constantly updating evasion techniques, the detection of botnets has been always an unaddressed challenge. To cope with this, we propose a new approach to detect botnet activity based on the dynamical modeling of traffic behavior. Indeed, some important features of network traffic such as packet length, sending protocol, source-IP, destination-IP, and sending time are extracted by the Wireshark software. To explore the effect of evasion methods on the network behavior, based on the extracted features, some time series have been plotted to analyze and classify the network traffic characteristics as bots are active. Due to the drastic changing of some features during evasion techniques, several suspicious behaviors are explored as chaotic dynamical behavior in the aforementioned time series to use in the definition of the final benchmark detection mechanism. To check the accuracy of the performance, two datasets ISCX IDS 2012 and CTU-Malware-Capture-Botnet-254-1 are used. The simulation results show that the proposed method has a detection rate of over 99%, the false positive rate less than 0.67%.

show abstract

Section: Results Of the Implementation Of The First And Second Benchmarksmentioning

confidence: 85%

“…Computer Engineering Department, Imam Reza International University, Mashhad, Iran intelligence algorithms have been used to provide detection models, and most of the studies have focused on DNS traffic [3][4][5][6][7][8][9]. In recent years, multi-layer networks have become the backbone of networked scientific research.…”

Section: Introductionmentioning

confidence: 99%

A Novel Approach of Botnets Detection Based on Analyzing Dynamical Network Traffic Behavior

2021

View full text Add to dashboard Cite

show abstract

“…e literature [73] proposed a method that combines reinforcement learning technology to detect botnets as early as possible in the propagation stage or before any malicious activities are initiated by the bot. It included four stages: network traffic capture and packet filtering, feature extraction, malicious activity detection, and bot behavior detection using reinforcement learning.…”

Section: Fnnmentioning

confidence: 99%

Survey on Botnet Detection Techniques: Classification, Methods, and Evaluation

Xing

Hui

Zhao

et al. 2021

Mathematical Problems in Engineering

View full text Add to dashboard Cite

With the continuous evolution of the Internet, as well as the development of the Internet of Things, smart terminals, cloud platforms, and social platforms, botnets showing the characteristics of platform diversification, communication concealment, and control intelligence. This survey analyzes and compares the most important efforts in the botnet detection area in recent years. It studies the mechanism characteristics of botnet architecture, life cycle, and command and control channel and provides a classification of botnet detection techniques. It focuses on the application of advanced technologies such as deep learning, complex network, swarm intelligence, moving target defense (MTD), and software-defined network (SDN) for botnet detection. From the four dimensions of service, intelligence, collaboration, and assistant, a common bot detection evaluation system (CBDES) is proposed, which defines a new global capability measurement standard. Combing with expert scores and objective weights, this survey proposes quantitative evaluation and gives a visual representation for typical detection methods. Finally, the challenges and future trends in the field of botnet detection are summarized.

show abstract

“…Resource optimization of smart grids, motor anomalies and biological data with RL was addressed in [28][29][30], respectively. Network intrusion detection based on RL were proposed in [31][32][33][34]. Although all these paper claimed effectiveness of their general purpose RL models, more independent replays and extensive comparisons among SOTA model could be more persuasive.…”

Section: Related Researchesmentioning

confidence: 99%

Application of Improved Asynchronous Advantage Actor Critic Reinforcement Learning Model on Anomaly Detection

Zhou

Wang

et al. 2021

Entropy

View full text Add to dashboard Cite

Anomaly detection research was conducted traditionally using mathematical and statistical methods. This topic has been widely applied in many fields. Recently reinforcement learning has achieved exceptional successes in many areas such as the AlphaGo chess playing and video gaming etc. However, there were scarce researches applying reinforcement learning to the field of anomaly detection. This paper therefore aimed at proposing an adaptable asynchronous advantage actor-critic model of reinforcement learning to this field. The performances were evaluated and compared among classical machine learning and the generative adversarial model with variants. Basic principles of the related models were introduced firstly. Then problem definitions, modelling processes and testing were detailed. The proposed model differentiated the sequence and image from other anomalies by proposing appropriate neural networks of attention mechanism and convolutional network for the two kinds of anomalies, respectively. Finally, performances with classical models using public benchmark datasets (NSL-KDD, AWID and CICIDS-2017, DoHBrw-2020) were evaluated and compared. Experiments confirmed the effectiveness of the proposed model with the results indicating higher rewards and lower loss rates on the datasets during training and testing. The metrics of precision, recall rate and F1 score were higher than or at least comparable to the state-of-the-art models. We concluded the proposed model could outperform or at least achieve comparable results with the existing anomaly detection models.

show abstract

An efficient reinforcement learning-based Botnet detection approach

Cited by 102 publications

References 67 publications

A Novel Approach of Botnets Detection Based on Analyzing Dynamical Network Traffic Behavior

A Novel Approach of Botnets Detection Based on Analyzing Dynamical Network Traffic Behavior

Survey on Botnet Detection Techniques: Classification, Methods, and Evaluation

Application of Improved Asynchronous Advantage Actor Critic Reinforcement Learning Model on Anomaly Detection

Contact Info

Product

Resources

About