Behaviour analysis of machine learning algorithms for detecting P2P botnets

Garg, Shree; Singh, Ankush K.; Sarje, Anil K.; Peddoju, Sateesh K.

doi:10.1109/icact.2013.6710523

Cited by 30 publications

(14 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…S. Garg et al [2] performed a comparison of three machine learning techniques commonly used for the detection of decentralized botnets: C4.5, Nearest Neighbours, and Bayesian Network. They used features based on connection intervals of time.…”

Section: Related Work On Algorithms For Detecting Botnetsmentioning

confidence: 99%

Botnet Detection using Clustering Algorithms

Alejandre¹,

Cortés²,

Anaya³

2016

RCS

View full text Add to dashboard Cite

In this paper, some clustering techniques are analyzed to compare their ability to detect botnet traffic by selecting features that distinguish connections belonging to or not belonging to a botnet. By considering the history of network's connections, some clustering algorithms are used to derive a set of rules to decide which should be considered as a botnet. Our main contribution is to evaluate different clustering techniques to detect botnets based on their detection rate (true and false positives). The algorithms used are K-medoids and K-means clustering. Datasets used in this paper were extracted from the repositories ISOT and ISCX. Results on K-medoids were better for almost all the experiments than K-means.

show abstract

Section: Related Work On Algorithms For Detecting Botnetsmentioning

confidence: 99%

Botnet Detection using Clustering Algorithms

Alejandre¹,

Cortés²,

Anaya³

2016

RCS

View full text Add to dashboard Cite

show abstract

“…Garg focused on the traffic characteristics such as the size of the packets, the number of packets, the size of the payloads, and the packet length per flow or host and used a machine learning algorithm to detect P2P botnets [7].…”

Section: Previous Workmentioning

confidence: 99%

Evaluating Header Information Features for Malware Infection Detection

Ichino

Kawamoto

Iwano

et al. 2015

Journal of Information Processing

View full text Add to dashboard Cite

We analyzed traffic data after a malware infection and clarified which features would be the most effective in the detection of infection. The focus is on the use of traffic data to detect infections and on the use of features that do not change much over time from those of the training data. The characteristics of features that are effective for detecting malware infections are also described. Experimental results clarified the effects of the time difference, and the effective features that were little affected by the time difference were identified. There is thus a need to focus on the effect of the time difference when investigating malware infection detection.

show abstract

“…e textual spam e-mail classification can be analyzed using KNN model [3]; the author used summarization technique for knowledge extraction. P2P botnet traffic can be classified by differentiating the features using the machine learning algorithm [4]. e authors extracted 17 features first and then removed five features from them because of the nominal values.…”

Section: Introductionmentioning

confidence: 99%

“…Garg et al [4] Lin and Chen [19] Ye et al [20] Bijalwan et al [11] Cadenas et al [21] Liu et al [13] Classifier 1 1 1 1 3 1 3 8…”

mentioning

confidence: 99%

Botnet Forensic Analysis Using Machine Learning

Bijalwan

2020

Security and Communication Networks

View full text Add to dashboard Cite

Botnet forensic analysis helps in understanding the nature of attacks and the modus operandi used by the attackers. Botnet attacks are difficult to trace because of their rapid pace, epidemic nature, and smaller size. Machine learning works as a panacea for botnet attack related issues. It not only facilitates detection but also helps in prevention from bot attack. The proposed inquisition model endeavors improved quality of results by comprehensive botnet detection and forensic analysis. This scenario has been applied in eight different combinations of ensemble classifier technique to detect botnet evidence. The study is also compared to the ensemble-based classifiers with the single classifier using different parameters. The results exhibit that the proposed model can improve accuracy over a single classifier.

show abstract

Behaviour analysis of machine learning algorithms for detecting P2P botnets

Cited by 30 publications

References 4 publications

Botnet Detection using Clustering Algorithms

Botnet Detection using Clustering Algorithms

Evaluating Header Information Features for Malware Infection Detection

Botnet Forensic Analysis Using Machine Learning

Contact Info

Product

Resources

About