Benchmark-Based Reference Model for Evaluating Botnet Detection Tools Driven by Traffic-Flow Analytics

Abstract

Botnets are some of the most recurrent cyber-threats, which take advantage of the wide heterogeneity of endpoint devices at the Edge of the emerging communication environments for enabling the malicious enforcement of fraud and other adversarial tactics, including malware, data leaks or denial of service. There have been significant research advances in the development of accurate botnet detection methods underpinned on supervised analysis but assessing the accuracy and performance of such detection methods requires a clear evaluation model in the pursuit of enforcing proper defensive strategies. In order to contribute to the mitigation of botnets, this paper introduces a novel evaluation scheme grounded on supervised machine learning algorithms that enable the detection and discrimination of different botnets families on real operational environments. The proposal relies on observing, understanding and inferring the behavior of each botnet family based on network indicators measured at flow-level. The assumed evaluation methodology contemplates six phases that allow building a detection model against botnet-related malware distributed through the network, for which five supervised classifiers were instantiated were instantiated for further comparisons—Decision Tree, Random Forest, Naive Bayes Gaussian, Support Vector Machine and K-Neighbors. The experimental validation was performed on two public datasets of real botnet traffic—CIC-AWS-2018 and ISOT HTTP Botnet. Bearing the heterogeneity of the datasets, optimizing the analysis with the Grid Search algorithm led to improve the classification results of the instantiated algorithms. An exhaustive evaluation was carried out demonstrating the adequateness of our proposal which prompted that Random Forest and Decision Tree models are the most suitable for detecting different botnet specimens among the chosen algorithms. They exhibited higher precision rates whilst analyzing a large number of samples with less processing time. The variety of testing scenarios were deeply assessed and reported to set baseline results for future benchmark analysis targeted on flow-based behavioral patterns.

Machine-Learning-Enabled Intrusion Detection System for Cellular Connected UAV Networks

“…A comparison is given in Table 9. It should be noted that the result for DT is as achieved by the authors in [65], with a 99.99% accuracy rate for the Botnet attack. Moreover, the accuracy rate for KNN is 99.984% in [65], which is same as our result.…”

“…It should be noted that the result for DT is as achieved by the authors in [65], with a 99.99% accuracy rate for the Botnet attack. Moreover, the accuracy rate for KNN is 99.984% in [65], which is same as our result. The result achieved by the authors in [66] is similar to our case, which is about 99.99% for KNN and DT and almost same as our result, but our results are slightly better than [9] in the case of the LDA algorithm.…”

Ensemble Learning for Threat Classification in Network Intrusion Detection on a Security Monitoring System for Renewable Energy

“…In contrast to [14,17], proposed approach has advantages on better multi-class classification accuracy on UNSW-NB15 dataset by incorporating with C4.5 DT algorithm to the model overfitting prevented from inputting additional variables to avoid learning the noise in the training data. Moreover, Table 14 indicates that the proposed approach achieved the binary accuracy close to those of [32] on CIC-IDS 2018. However, the multi-classification accuracy was 96.53% is slightly lower than that of [19].…”

Intelligent Techniques for Detecting Network Attacks: Review and Research Directions

“…A novel scheme using supervised learning algorithms and an improved dataset to detect botnet traffic was carried out by Ramos et al [71]. Five ML classifiers were evaluated namely, DT, RF, SVM, NB, and KNN on two datasets: CICIDS2018 and ISOT HTTP [72] Botnet (total size 420 GB).…”