Hybrid Feature Selection Models for Machine Learning Based Botnet Detection in IoT Networks

Guerra-Manzanares, Alejandro; Bahşi, Hayretdin; Nõmm, Sven

doi:10.1109/cw.2019.00059

Cited by 35 publications

(19 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In a similar work [67], the authors did not evaluate the performance of the proposed method. In another work [68], Guerra-Manzanares et al did not evaluate the performance of the proposed method with the network traffic data in the Bot-IoT dataset.…”

Section: Related Workmentioning

confidence: 99%

Hybrid Deep Learning for Botnet Attack Detection in the Internet-of-Things Networks

Popoola

Adebisi

Hammoudeh

et al. 2021

IEEE Internet Things J.

146

View full text Add to dashboard Cite

Deep Learning (DL) is an efficient method for botnet attack detection. However, the volume of network traffic data and memory space required is usually large. It is, therefore, almost impossible to implement the DL method in memory-constrained IoT devices. In this paper, we reduce the feature dimensionality of large-scale IoT network traffic data using the encoding phase of Long Short-Term Memory Autoencoder (LAE). In order to classify network traffic samples correctly, we analyse the longterm interrelated changes in the low-dimensional feature set produced by LAE using deep Bidirectional Long Short-Term Memory (BLSTM). Extensive experiments are performed with the BoT-IoT dataset to validate the effectiveness of the proposed hybrid DL method. Results show that LAE significantly reduced the memory space required for large-scale network traffic data storage by 91.89%, and it outperformed state-of-the-art feature dimensionality reduction methods by 18.92 − 27.03%. Despite the significant reduction in feature size, the deep BLSTM model demonstrates robustness against model under-fitting and overfitting. It also achieves good generalisation ability in binary and multi-class classification scenarios.

show abstract

Section: Related Workmentioning

confidence: 99%

Hybrid Deep Learning for Botnet Attack Detection in the Internet-of-Things Networks

Popoola

Adebisi

Hammoudeh

et al. 2021

IEEE Internet Things J.

146

View full text Add to dashboard Cite

show abstract

“…Em termos de desempenho dos classificadores, observa-se que o método de Floresta Randômicas teve os melhores resultados na maioria dos casos, de forma similar ao que foi obtido por [Guerra-Manzanares et al 2019]. Esse resultado expressivo deve-se ao fato de se tratar de um dos métodos de ensemble learning, os quais são mais robustos e tendem a ter melhor desempenho [Opitz and Maclin 1999].…”

Section: Análise Dos Resultadosunclassified

“…No trabalho de Guerra-Manzanares et al [Guerra-Manzanares et al 2019],é realizada uma comparação de desempenho entre métodos de seleção de características no contexto de detecção de botnets em redes IoT. Os autores utilizam uma base de dados criada por [Koroniotis et al 2018] contendo ataques botnets em redes IoT, como Mirai e o Bashlite, disponível no site do projeto 1 .…”

Section: Trabalhos Relacionadosunclassified

Seleção de Características por Clusterização para Melhorar a Detecção de Ataques de Rede

Abreu¹,

Carvalho²,

Abelém³

et al. 2020

Anais XXXVIII Simpósio Brasileiro De Redes De Computadores E Sistemas Distribuídos (SBRC 2020)

View full text Add to dashboard Cite

Sistemas de Detecção de Intrusão (IDSs) baseados em aprendizado de máquina (AM) vêm sendo amplamente utilizados para detectar tráfego malicioso e ataques às redes. Entretanto, essas abordagens ainda apresentam grandes dificuldades para detectar os diferentes tipos de ataques que vêm se aprimorando. Neste contexto, dentre os passos requeridos para uma avaliação baseada em AM, a seleção de características tem grande importância para propiciar maior eficiência na detecção de anomalias e ataques de rede, sendo ainda um problema em aberto. Este artigo propõe uma abordagem que realiza a seleção de características baseada em clusters para melhorar a detecção de ataques e tráfegos anômalos na rede. A proposta cria também um ranque com as características de tráfego que mais contribuíram para o incremento nos acertos dos algoritmos. Os resultados mostraram um desempenho superior às demais propostas avaliadas para cinco diferentes tipos de ataques, considerando a métrica F1 score.

show abstract

“…For selecting a feature subset capable of maintaining a reasonable detection rate and reducing the time spent on the classification by the ML models, we elaborated the following methodology. First, as recommended by [20] we used a wrapper method to select the three features that contribute the most to the F1 score. One common wrapper strategy usually followed is to rank the importance of each feature, and then to check the evolution of the F1 score when adding the features one by one according to such ranking [22], [23], [28].…”

Section: Methodsmentioning

confidence: 99%

Efficient Detection of Botnet Traffic by Features Selection and Decision Trees

Velasco-Mata¹,

González-Castro

Fidalgo

et al. 2021

IEEE Access

View full text Add to dashboard Cite

Botnets are one of the online threats with the most significant presence, causing billionaire losses to global economies. Nowadays, the increasing number of devices connected to the Internet makes it necessary to analyze extensive network traffic data. In this work, we focus on increasing the performance of botnet traffic classification by selecting those features that further increase the detection rate. For this purpose, we use two feature selection techniques, i.e., Information Gain and Gini Importance, which led to three pre-selected subsets of five, six and seven features. Then, we evaluate the three feature subsets and three models, i.e., Decision Tree, Random Forest and k-Nearest Neighbors. To test the performance of the three feature vectors and the three models, we generate two datasets based on the CTU-13 dataset, namely QB-CTU13 and EQB-CTU13. Finally, we measure the performance as the macro averaged F1 score over the computational time required to classify a sample. The results show that the highest performance is achieved by Decision Trees using a five feature set, which obtained a mean F1 score of 85% classifying each sample in an average time of 0.78 microseconds.

show abstract

Hybrid Feature Selection Models for Machine Learning Based Botnet Detection in IoT Networks

Cited by 35 publications

References 13 publications

Hybrid Deep Learning for Botnet Attack Detection in the Internet-of-Things Networks

Hybrid Deep Learning for Botnet Attack Detection in the Internet-of-Things Networks

Seleção de Características por Clusterização para Melhorar a Detecção de Ataques de Rede

Efficient Detection of Botnet Traffic by Features Selection and Decision Trees

Contact Info

Product

Resources

About