Analysis of Botnet Attack Communication Pattern Behavior on Computer Networks

Abstract

Botnets are a severe threat to a computer network, affecting various aspects of security systems, including spreading malicious programs, phishing, sending spam messages, and click fraud. Because of their negative consequences, botnets must be identified early. Nevertheless, their different characteristics have made them challenging to detect. This research proposes a bot patterns communication detection from traffic flows analysis consisting of three main activities: bot detection, extraction, and communication behavior analysis phases. This proposed model aims to obtain a specific behavior of bot attacks, which can be used as an early warning bots attack system. The process of bot patterns communication detection depends on the accuracy of bot detection, so the model improves the pre-processing phase and uses multi-model classification. Improvement in the pre-processing phase is carried out in the feature engineering section using the concept of one-hot encoding. Several machine learning classification models are used to obtain the best detection accuracy: Decision tree, Random forest, Logistic regression, k-NN, and Naïve Bayes. Furthermore, the model has been tested on two different datasets, namely the NCC and CTU-13. The experimental results show that the proposed model is optimal and recognizes bot activities well. The accuracy detection is obtained at 99.99%. Besides, the model can also identify the bot's attack activity scenario and communication behavior in three types: centralized, distributed, and spread.

Botnet dataset with simultaneous attack activity

“…Bot activity is obtained by extracting bot behavior from scenario 1 to 13 datasets on CTU-13 and NCC [1 , 2] . The extraction process is carried out to analyze bot attack behavior and normal behavior [3] , whose extraction path is shown in Fig. 4 .…”

“…The dataset simulates botnet attacks using botnet activities described in CTU-13 [1] and NCC [2] . The simulation extracts all scenarios from those two datasets to determine attack activities, attack phases, and the time difference between attacks and normal activities [3] , leading to four scenarios represented by the corresponding sub-datasets. Additionally, it is assumed that this simulation employs three sensors.…”

Analysis of Weight-Based Voting Classifier for Intrusion Detection System

“…Basically, data transformation is a series of techniques used to change raw data into a form or format that is more suitable or useful for machine learning models. Data transformation was implemented in this research because several categorical features in the dataset need to be converted to numerical data [31]. This is an essential step because categorical data cannot be processed with some machine learning methods.…”

Botnet Attack Analysis through Graph Visualization

“…This detection model has been widely developed because it produces optimal reliability, simplicity, accuracy, and time processing [8][9][10]. Signature-based models extract botnet attack characteristics such as attack communication pattern behavior [11], features [12], attack sequential patterns [6], number of attack stages [13], and attack time gap [14]. However, there needs to be more focus on analyzing botnet communication intensity using visualization with a graph analysis approach.…”