Real-time botnet detection on large network bandwidths using machine learning

Abstract

Botnets are one of the most harmful cyberthreats, that can perform many types of cyberattacks and cause billionaire losses to the global economy. Nowadays, vast amounts of network traffic are generated every second, hence manual analysis is impossible. To be effective, automatic botnet detection should be done as fast as possible, but carrying this out is difficult in large bandwidths. To handle this problem, we propose an approach that is capable of carrying out an ultra-fast network analysis (i.e. on windows of one second), without a significant loss in the F1-score. We compared our model with other three literature proposals, and achieved the best performance: an F1 score of 0.926 with a processing time of 0.007 ms per sample. We also assessed the robustness of our model on saturated networks and on large bandwidths. In particular, our model is capable of working on networks with a saturation of 10% of packet loss, and we estimated the number of CPU cores needed to analyze traffic on three bandwidth sizes. Our results suggest that using commercial-grade cores of 2.4 GHz, our approach would only need four cores for bandwidths of 100 Mbps and 1 Gbps, and 19 cores on 10 Gbps networks.

Reviewing various feature selection techniques in machine learning‐based botnet detection

“…Mata et al 57 have developed a botnet detection model in real time using a decision tree classifier. For this purpose, they have taken a very small feature set of only four features.…”

DL-SAFE: Proteção Baseada em Aprendizado Profundo para Detecção de Botnets na Borda

“…Por se tratar de treinamento adaptativo, um aspecto central de seu trabalho é como lidar com a deriva de conceito (concept drift) decorrente de mudanc ¸as nos padrões de tráfego da rede IoT. Velasco-Mata et al realiza detecc ¸ão de botnets usando aprendizado de máquina em redes de alta velocidade [Velasco-Mata et al 2023]. O trabalho emprega uma árvore de decisão e usa um conjunto de quatro características simples acoplados a uma janela de tempo de um segundo, com o objetivo de otimizar o desempenho da proposta.…”

Enhancing Botnet Detection in Network Security Using Profile Hidden Markov Models

“…Unsupervised machine learning using clustering algorithms, like k-means, x-means, and EM clustering, was utilized for botnet detection, revealing dissimilarities between botnet flow data and normal data [12]. Real-time botnet analysis was addressed by [13], using machine learning with minimal features. Behavior-based approaches with machine learning algorithms, such as Multilayer Perceptron, k-Nearest Neighbor, and Support Vector Machine, were shown to be effective for botnet detection [14].…”