Mobile Botnet Detection: A Deep Learning Approach Using Convolutional Neural Networks

Yerima, Suleiman Y.; Alzaylaee, Mohammed K.

doi:10.1109/cybersa49311.2020.9139664

Cited by 26 publications

(15 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They achieved this by observing the code behaviour of known malware binaries that possess command and control features. In [40], an Android botnet detection system based on deep learning was proposed. The system is based on 342 static features including permissions, API calls, extra files, commands and intents.…”

Section: Botnet Detection On Androidmentioning

confidence: 99%

A Novel Android Botnet Detection System Using Image-Based and Manifest File Features

Yerima

Bashar

2022

Electronics

Self Cite

View full text Add to dashboard Cite

Malicious botnet applications have become a serious threat and are increasingly incorporating sophisticated detection avoidance techniques. Hence, there is a need for more effective mitigation approaches to combat the rise of Android botnets. Although the use of Machine Learning to detect botnets has been a focus of recent research efforts, several challenges remain. To overcome the limitations of using hand-crafted features for Machine-Learning-based detection, in this paper, we propose a novel mobile botnet detection system based on features extracted from images and a manifest file. The scheme employs a Histogram of Oriented Gradients and byte histograms obtained from images representing the app executable and combines these with features derived from the manifest files. Feature selection is then applied to utilize the best features for classification with Machine-Learning algorithms. The proposed system was evaluated using the ISCX botnet dataset, and the experimental results demonstrate its effectiveness with F1 scores ranging from 0.923 to 0.96 using popular Machine-Learning algorithms. Furthermore, with the Extra Trees model, up to 97.5% overall accuracy was obtained using an 80:20 train–test split, and 96% overall accuracy was obtained using 10-fold cross validation.

show abstract

Section: Botnet Detection On Androidmentioning

confidence: 99%

A Novel Android Botnet Detection System Using Image-Based and Manifest File Features

Yerima

Bashar

2022

Electronics

Self Cite

View full text Add to dashboard Cite

show abstract

“…Similarly, ref. [7] proposes an Android botnet detection approach based on CNN, where not only permissions were used as features but also API calls, Commands, Intents, and Extra Files. Unlike in ref.…”

Section: Related Workmentioning

confidence: 99%

“…As mentioned earlier, the ISCX Android botnet dataset from [9] was utilized for the experiments in this paper. This dataset contains 1929 botnet apps and has been employed in previous works including [6][7][8][10][11][12][13]22]. Table 3 shows the distribution of samples within the 14 different botnet families present in the dataset.…”

Section: Dataset Used For the Investigationmentioning

confidence: 99%

See 1 more Smart Citation

Deep Learning Techniques for Android Botnet Detection

Yerima

Alzaylaee

Shajan³

et al. 2021

Electronics

Self Cite

View full text Add to dashboard Cite

Android is increasingly being targeted by malware since it has become the most popular mobile operating system worldwide. Evasive malware families, such as Chamois, designed to turn Android devices into bots that form part of a larger botnet are becoming prevalent. This calls for more effective methods for detection of Android botnets. Recently, deep learning has gained attention as a machine learning based approach to enhance Android botnet detection. However, studies that extensively investigate the efficacy of various deep learning models for Android botnet detection are currently lacking. Hence, in this paper we present a comparative study of deep learning techniques for Android botnet detection using 6802 Android applications consisting of 1929 botnet applications from the ISCX botnet dataset. We evaluate the performance of several deep learning techniques including: CNN, DNN, LSTM, GRU, CNN-LSTM, and CNN-GRU models using 342 static features derived from the applications. In our experiments, the deep learning models achieved state-of-the-art results based on the ISCX botnet dataset and also outperformed the classical machine learning classifiers.

show abstract

“…In the context of botnet detection, supervised ML methods are commonly used for the implementation of network traffic classifiers, able to distinguish between benign and malicious traffic by assigning the corresponding label to each log or by identifying traffic belonging to different botnets. A number of techniques have demonstrated good detection results in this line of work, including Support Vector Machines [13], tree-based methods [14], and modern neural network-based architectures [15] [16].…”

Section: Related Workmentioning

confidence: 99%

IoT Botnet Detection on Flow Data using Autoencoders

Kompougias

Papadopoulos

Mantas

et al. 2021

2021 IEEE International Mediterranean Conference on Communications and Networking (MeditCom)

View full text Add to dashboard Cite

The rapid growth of the Internet of Things and the proliferation of easily compromisable IoT devices has led to a drastic increase in the occurrence of IoT-based botnet attacks. Hackers are keen on exploiting the vulnerabilities of smart devices, which are seen as easy targets often lacking robust security mechanisms. Identifying botnet activity is an active research topic and remains a challenging task due to the continuous evolution of botnet families that employ a large number of attack vectors. Traditional rule-based approaches which rely on signature matching, heuristics and behavioral profiling are always lagging one step behind the attacker, leading researchers to the development of machine and deep learning methods for the detection of compromised IoT device behaviour. In this paper, we model botnet traffic identification as an anomaly detection task, aiming at establishing a baseline of benign traffic, in order to detect unusual behavior using Netflow data. We propose a feature engineering and deep learning-based detection framework based on two Autoencoder architectures: (i) a vanilla implementation of a deep Autoencoder and (ii) GANomaly which has never been used in the context of network traffic analysis before. We validate the performance of the proposed methodology on the CICIDS2017 dataset which has been widely used for cybersecurity benchmarks and show that it is possible to induce highly accurate unsupervised learning models to detect previously unseen botnet behaviour.

show abstract

Mobile Botnet Detection: A Deep Learning Approach Using Convolutional Neural Networks

Cited by 26 publications

References 17 publications

A Novel Android Botnet Detection System Using Image-Based and Manifest File Features

A Novel Android Botnet Detection System Using Image-Based and Manifest File Features

Deep Learning Techniques for Android Botnet Detection

IoT Botnet Detection on Flow Data using Autoencoders

Contact Info

Product

Resources

About