Tracking Temporal Evolution of Network Activity for Botnet Detection

Sinha, Kapil; Viswanathan, Arun; Bunn, J.

doi:10.48550/arxiv.1908.03443

Cited by 6 publications

(12 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…RNN is well-known for capturing sequential characteristics of network traffic data. For example, Sinha et al [14] proposed a supervised approach to detect botnet hosts by tracking the network activities over time and extract graph-based features from NetFlow data for botnet detection. However, their technique only extracted features for each host IP address separately.…”

Section: B Botnet Detection Methodology Using MLmentioning

confidence: 99%

“…One of the critical limitations is that these algorithms did not pay much attention to sequential patterns within network data, even though botnet traffic shows repeated patterns due to the nature of the pre-programmed activities [13]. There are studies considered sequential characteristics by the same source IP addresses, which may not be generalized to other IP addresses [14], [15]. In addition, existing studies only consider specific types of network activities, such as IRC, P2P, and HTTP traffic, while active botnets are utilizing a combination of different protocols [14]- [17].…”

Section: Introductionmentioning

confidence: 99%

“…There are studies considered sequential characteristics by the same source IP addresses, which may not be generalized to other IP addresses [14], [15]. In addition, existing studies only consider specific types of network activities, such as IRC, P2P, and HTTP traffic, while active botnets are utilizing a combination of different protocols [14]- [17].…”

Section: Introductionmentioning

confidence: 99%

“…First, we propose an ML method capable to represent sequential patterns within network data, by utilizing Recurrent Variational Autoencoder (RVAE). From published literature, we know that sequential patterns of activities are critical for detecting many botnets [14], [15]. The proposed method also includes a new anomaly scoring function that allows on-line detection of botnets.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Improving Botnet Detection with Recurrent Neural Network and Transfer Learning

Kim,

Sim,

Kim

et al. 2021

Preprint

View full text Add to dashboard Cite

Botnet detection is a critical step in stopping the spread of botnets and preventing malicious activities. However, reliable detection is still a challenging task, due to a wide variety of botnets involving ever-increasing types of devices and attack vectors. Recent approaches employing machine learning (ML) showed improved performance than earlier ones, but these MLbased approaches still have significant limitations. For example, most ML approaches can not incorporate sequential pattern analysis techniques key to detect some classes of botnets. Another common shortcoming of ML-based approaches is the need to retrain neural networks in order to detect the evolving botnets; however, the training process is time-consuming and requires significant efforts to label the training data. For fast-evolving botnets, it might take too long to create sufficient training samples before the botnets have changed again. To address these challenges, we propose a novel botnet detection method, built upon Recurrent Variational Autoencoder (RVAE) that effectively captures sequential characteristics of botnet activities. In the experiment, this semi-supervised learning method achieves better detection accuracy than similar learning methods, especially on hard to detect classes. Additionally, we devise a transfer learning framework to learn from a well-curated source data set and transfer the knowledge to a target problem domain not seen before. Tests show that the true-positive rate (TPR) with transfer learning is higher than the RVAE semi-supervised learning method trained using the target data set (91.8% vs. 68.3%).

show abstract

Section: B Botnet Detection Methodology Using MLmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Improving Botnet Detection with Recurrent Neural Network and Transfer Learning

Kim,

Sim,

Kim

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…In [28], the authors used a sequence of graphs to model the time evolution of the network traffic, in which nodes are the hosts (in the form of IP addresses) of the network, and edges are the packets exchanged by hosts. After generating these graphs, time series are extracted from each node by computing a set of graph-based features (e.g., in/out-degree, or in/out-neighbors).…”

Section: Automatic Extraction Of Featuresmentioning

confidence: 99%

On the Evaluation of Sequential Machine Learning for Network Intrusion Detection

Andrea

Yang

2021

Proceedings of the 16th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Recent advances in deep learning renewed the research interests in machine learning for Network Intrusion Detection Systems (NIDS). Specifically, attention has been given to sequential learning models, due to their ability to extract the temporal characteristics of Network traffic Flows (NetFlows), and use them for NIDS tasks. However, the applications of these sequential models often consist of transferring and adapting methodologies directly from other fields, without an in-depth investigation on how to leverage the specific circumstances of cybersecurity scenarios; moreover, there is a lack of comprehensive studies on sequential models that rely on NetFlow data, which presents significant advantages over traditional full packet captures. We tackle this problem in this paper. We propose a detailed methodology to extract temporal sequences of NetFlows that denote patterns of malicious activities. Then, we apply this methodology to compare the efficacy of sequential learning models against traditional static learning models. In particular, we perform a fair comparison of a 'sequential' Long Short-Term Memory (LSTM) against a 'static' Feedforward Neural Networks (FNN) in distinct environments represented by two well-known datasets for NIDS: the CICIDS2017 and the CTU13. Our results highlight that LSTM achieves comparable performance to FNN in the CICIDS2017 with over 99.5% F1-score; while obtaining superior performance in the CTU13, with 95.7% F1-score against 91.5%. This paper thus paves the way to future applications of sequential learning models for NIDS. CCS CONCEPTS• Security and privacy → Intrusion detection systems; Network security; • Computing methodologies → Temporal reasoning.

show abstract