Analyzing The Effect of Network Traffic Segmentation on The Accuracy of Botnet Activity Detection

Putra, Muhammad Aidiel Rachman; Yuhana, Umi Laili; Ahmad, Tohari; Hostiadi, Dandy Pramana

doi:10.1109/cenim56801.2022.10037365

Cited by 2 publications

(1 citation statement)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Botnets peform attacks in stages [6,13], so activity grouping is needed to ensure the attack activity is a series. Previous research grouped activities into static segments of one hour [30,31] and developed them into segments with sliding time windows [13]. In this research, activity grouping is carried out by analyzing the distance between attacks.…”

Section: Activity Groupingmentioning

confidence: 99%

Botnet Attack Analysis through Graph Visualization

2024

IJIES

View full text Add to dashboard Cite

Botnet attacks on computer networks require proper handling because they can have dangerous consequences. Botnets are dynamic and able to evolve quickly. A botnet can resemble normal activity, making it challenging to detect. Previous research has introduced botnet detection models but has not focused on analyzing intensity behavior based on incoming and outgoing flows in graph visualization. This analysis is needed to get the botnet attack flow. This paper proposes a detection and comprehensive analysis of botnet attack behavior based on a directed graph. The goal is to detect the attacker and extract the behavior from the directed graph. First, all network traffic is grouped based on the time distance between activities. Visualization is carried out by representing the attacker and target as nodes in every activity group and analyzing the direction of communication in the form of in-degree and out-degree. Meanwhile, interactions are represented in edges and weighted edges based on activity intensity. Then, all graph representation is extracted for classification using random forest, decision tree, support vector classification, Naïve bayes, k -nearest neighbors, logistic regression, and XGBoost. In the experiment, three different datasets are used, namely CTU-13, NCC-1, and NCC-2. The proposed approaches perform well, with an average of 99.97% accuracy, 46.82% precision, and 83.33% recall. These results can form a knowledge base of botnet attacks that can be used in attack detection models on the network.

show abstract