Ensemble Machine Learning Techniques for Accurate and Efficient Detection of Botnet Attacks in Connected Computers

Afrifa, Stephen; Vijayakumar, V.; Appiahene, Peter; Zhang, Tao; Domfeh, Emmanuel Adjei

doi:10.3390/eng4010039

Cited by 13 publications

(5 citation statements)

References 42 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Afrifa et al [17] start with the assumption that significant numbers of IoT devices are regularly commandeered into botnets by malicious actors to further nefarious goals that threaten global commerce. Due to resource constraints of typical IoT devices, a single compromised device may not be particularly dangerous, but a botnet comprised of thousands or millions of compromised devices can cause significant harm.…”

Section: Related Workmentioning

confidence: 99%

Using Ensemble Learning for Anomaly Detection in Cyber–Physical Systems

Jeffrey,

Tan,

Villar

2024

Electronics

View full text Add to dashboard Cite

The swift embrace of Industry 4.0 paradigms has led to the growing convergence of Information Technology (IT) networks and Operational Technology (OT) networks. Traditionally isolated on air-gapped and fully trusted networks, OT networks are now becoming more interconnected with IT networks due to the advancement and applications of IoT. This expanded attack surface has led to vulnerabilities in Cyber–Physical Systems (CPSs), resulting in increasingly frequent compromises with substantial economic and life safety repercussions. The existing methods for the anomaly detection of security threats typically use simple threshold-based strategies or apply Machine Learning (ML) algorithms to historical data for the prediction of future anomalies. However, due to the high levels of heterogeneity across different CPS environments, minimizing the opportunities for transfer learning, and the scarcity of real-world data for training, the existing ML-based anomaly detection techniques suffer from a poor predictive performance. This paper introduces a hybrid anomaly detection approach designed to identify threats to CPSs by combining the signature-based anomaly detection typically utilized in IT networks, the threshold-based anomaly detection typically utilized in OT networks, and behavioural-based anomaly detection using Ensemble Learning (EL), which leverages the strengths of multiple ML algorithms against the same dataset to increase the accuracy. Multiple public research datasets were used to validate the proposed approach, with the hybrid methodology employing a divide-and-conquer strategy to offload the detection of certain cyber threats to computationally inexpensive signature-based and threshold-based methods using domain knowledge to minimize the size of the behavioural-based data needed for ML model training, thus achieving a higher accuracy over a reduced timeframe. The experimental results showed accuracy improvements of 4–7% over those of the conventional ML classifiers in performing anomaly detection across multiple datasets, which is particularly important to the operators of CPS environments due to the high financial and life safety costs associated with interruptions to system availability.

show abstract

Section: Related Workmentioning

confidence: 99%

Using Ensemble Learning for Anomaly Detection in Cyber–Physical Systems

Jeffrey,

Tan,

Villar

2024

Electronics

View full text Add to dashboard Cite

show abstract

“…To assess the efficacy of the HM techniques, the RMSE, MAE, MAPE, and coefficient of determination (R 2 ) were utilised in this study. When RMSE and MAE decline and R 2 approaches one, the performance of HM strategies improves [45,46]. MAPE is an alternative statistical metric for evaluating a regression model's accuracy in terms of discrepancies between observed and predicted values.…”

Section: Statistical Analysis and Evaluation Metricsmentioning

confidence: 99%

Climate change impact assessment on groundwater level changes: A study of hybrid model techniques

Afrifa

Zhang

Xin

et al. 2023

IET Signal Processing

Self Cite

View full text Add to dashboard Cite

One of the most important sources of water supply is groundwater. However, the groundwater level (GWL) is significantly impacted by the global climate change. Therefore, under these more severe climate change conditions, the accurate and simple forecast of farmland GWL is a crucial component of agricultural water management. A hybrid model (HM) of Bayesian random forest (BRF), Bayesian support vector machine (BSVM), and Bayesian artificial neural network (BANN) is built in this study. The HM is made up of a Bayesian model averaging (BMA) and three machine learning models: random forest (RF), support vector machine (SVM), and artificial neural network. These three HMs are employed to help automate logical inference and decision‐making in business intelligence for groundwater management. For this purpose, data on 8 separate climatic factors that impact GWL changes in the study area were acquired. Nine distinct farming communities' GWL change data were utilised as the dependent variables for each model fit (community data). The effectiveness of the HM techniques was assessed using the evaluation metrics of mean absolute error (MAE), coefficient of determination (R2), mean absolute percent error (MAPE), and root mean square error (RMSE). The model fit in Suhum had the greatest performance with the highest accuracy (R2 varied from 0.9051 to 0.9679) and the lowest error scores (RMSE ranged from 0.0653 to 0.0727, and MAE ranged from 0.0121 to 0.0541), according to the models' evaluation results. The BRF delivered the greatest results when compared to the two independent HMs, the BSVM and BANN. Future GWL and climatic variable data may be trained using the trained HM techniques to determine the effects of climate change. Farmers, businesses, and civil society organisations might benefit from continuous monitoring of GWL data and education on climate change to help control and prevent excessive deteriorations of global climate change on GWL.

show abstract

“…Its disadvantage is that, due to its high false-positive rates, it is not a simple structure. Afrifa et al 43 demonstrated a method for precise and successful botnet attack detection in connected devices using ensemble machine-learning techniques. They employed the stacking ensemble technique and a decision tree classifier to identify botnets in computer network traffic with 99% accuracy.…”

Section: Literature Reviewmentioning

confidence: 99%

A novel hybrid feature selection and ensemble-based machine learning approach for botnet detection

Hossain,

Islam

2023

Sci Rep

View full text Add to dashboard Cite

In the age of sophisticated cyber threats, botnet detection remains a crucial yet complex security challenge. Existing detection systems are continually outmaneuvered by the relentless advancement of botnet strategies, necessitating a more dynamic and proactive approach. Our research introduces a ground-breaking solution to the persistent botnet problem through a strategic amalgamation of Hybrid Feature Selection methods—Categorical Analysis, Mutual Information, and Principal Component Analysis—and a robust ensemble of machine learning techniques. We uniquely combine these feature selection tools to refine the input space, enhancing the detection capabilities of the ensemble learners. Extra Trees, as the ensemble technique of choice, exhibits exemplary performance, culminating in a near-perfect 99.99% accuracy rate in botnet classification across varied datasets. Our model not only surpasses previous benchmarks but also demonstrates exceptional adaptability to new botnet phenomena, ensuring persistent accuracy in a landscape of evolving threats. Detailed comparative analyses manifest our model's superiority, consistently achieving over 99% True Positive Rates and an unprecedented False Positive Rate close to 0.00%, thereby setting a new precedent for reliability in botnet detection. This research signifies a transformative step in cybersecurity, offering unprecedented precision and resilience against botnet infiltrations, and providing an indispensable blueprint for the development of next-generation security frameworks.

show abstract

Ensemble Machine Learning Techniques for Accurate and Efficient Detection of Botnet Attacks in Connected Computers

Cited by 13 publications

References 42 publications

Using Ensemble Learning for Anomaly Detection in Cyber–Physical Systems

Using Ensemble Learning for Anomaly Detection in Cyber–Physical Systems

Climate change impact assessment on groundwater level changes: A study of hybrid model techniques

A novel hybrid feature selection and ensemble-based machine learning approach for botnet detection

Contact Info

Product

Resources

About