On Feature Selection Algorithms for Effective Botnet Detection

Abstract

The threats of botnets are becoming a growing concern infecting more and more computers every day. Although botnets can be detected from their behavioral patterns, it is becoming more challenging to differenti-ate the behavior between the malicious traffic and the legitimate trafficas with the advancement of the technologies the malicious traffics are fol-lowing the similar behavioral patterns of benign traffics. The detectionof malicious traffic largely depends on the traffic features that are beingused to feed in the detection process. Selecting the best features for effec-tive botnet detection is the main contribution of this paper. At the verybeginning, we show the impact of different features on botnet detectionprocess. Then we propose several heuristics to select the best featuresfrom a handful of possible features. Some proposed heuristics are trulyfeature-based and some are group-based, thus generating different accu-racy levels. We also analyze time complexity of each heuristic and providea detailed performance analysis. As working with all combinations of alarge number of features is not feasible, some heuristics work by groupingthe features based on their similarity in patterns and checking all combi-nations within the groups of small number of features which improves thetime complexity by a large margin. Through experiments we show the efficacy of the proposed feature selection heuristics. The result shows thatsome heuristics outperform state-of-the-art feature selection algorithms.

Reviewing various feature selection techniques in machine learning‐based botnet detection

“…Here, the classification algorithm functions as a black box, assessing the feature quality based on its learning performance while keeping its internal mechanisms undisclosed. 8 The estimated performance is then looped back into the feature generation module for the next iteration, where it is compared with the performance of the previously best subset. If a newly generated subset proves superior, it replaces the previous best subset.…”

“…Because of these advantages, FS has been extensively used in various fields, 5,8,12 such as biomedical, text mining, image analysis, customer relationship management, industrial applications, and so forth.…”

“…In the next step, a predefined classification algorithm evaluates the feature subset. Here, the classification algorithm functions as a black box, assessing the feature quality based on its learning performance while keeping its internal mechanisms undisclosed 8 . The estimated performance is then looped back into the feature generation module for the next iteration, where it is compared with the performance of the previously best subset.…”

“…By 2025, it is predicted that financial losses as a result of cyberattacks might reach USD 10.5 trillion. 8 For this reason, protection against botnet activity has become crucial. In recent years, botnets have become a prominent and persistent menace on the Internet, which has led to a greater focus and attention on study in this area.…”

“…It is clear that botnet attacks have caused significant financial and reputational damage for a number of major corporations. By 2025, it is predicted that financial losses as a result of cyberattacks might reach USD 10.5 trillion 8 . For this reason, protection against botnet activity has become crucial.…”