Security Hardening of Botnet Detectors Using Generative Adversarial Networks

Abstract

Machine learning (ML) based botnet detectors are no exception to traditional ML models when it comes to adversarial evasion attacks. The datasets used to train these models have also scarcity and imbalance issues. We propose a new technique named Botshot, based on generative adversarial networks (GANs) for addressing these issues and proactively making botnet detectors aware of adversarial evasions. Botshot is cost-effective as compared to the network emulation for botnet traffic data generation rendering the dedicated hardware resources unnecessary. First, we use the extended set of network flow and time-based features for three publicly available botnet datasets. Second, we utilize two GANs (vanilla, conditional) for generating realistic botnet traffic. We evaluate the generator performance using classifier two-sample test (C2ST) with 10-fold 70-30 train-test split and propose the use of 'recall' in contrast to 'accuracy' for proactively learning adversarial evasions. We then augment the train set with the generated data and test using the unchanged test set. Last, we compare our results with benchmark oversampling methods with augmentation of additional botnet traffic data in terms of average accuracy, precision, recall and F1 score over six different ML classifiers. The empirical results demonstrate the effectiveness of the GAN-based oversampling for learning in advance the adversarial evasion attacks on botnet detectors.

Evasion Generative Adversarial Network for Low Data Regimes

“…Authors in [23] compared 85 different oversampling techniques and suggested the three best-performing variants as SMOTE IPF, ProWSyn and polynom fit SMOTE. In [7], authors have compared the performance of these three SMOTE variants with GANs. Through empirical results, they found that GANs outperform the three mentioned oversamplers in most of the adversarial training of ML classifiers.…”

“…The quantitative analysis of EVAGAN was performed on CC datasets. We have followed the work done by the authors in [7] for dataset selection of botnet. We have used three datasets, ISCX-2014, CIC-2017 and CIC-2018, from the Canadian Institute of Cybersecurity (CIC).…”

“…Second, the emulated attacks may not accurately represent a real attack scenario. A cost-effective way of gathering the attacks' data is synthetic generation using AI generative models [7].…”

“…Using generative adversarial networks (GANs) as synthetic oversamplers has been a voguish research endeavour for low data regimes [3], [8]. Various researchers have demonstrated that GANs are more effective as compared to other synthetic oversamplers like SMOTE [2], [7], [9], [10]. It is found in numerous studies that due to the adversarial factor, GANs can better estimate the target probability distribution [2], [9], [11].…”

The geomorphological distribution of subaqueous tufa columns in a hypersaline lake: Mono Lake, U.S.A.

“…It can be observed from this table that we used 'sigmoid' in the output layer of G due to the reason that we wanted to generate the API data in which the values need to be between 0 and 1. We propose a GAN based methodology inspired by [20] that could mimic and generate the API based APK feature set. We propose the GAN evaluation by tweaking the classifier twosample test (C2ST) [21] for G performance evaluation.…”