Botnet Detection using Clustering Algorithms

Abstract

In this paper, some clustering techniques are analyzed to compare their ability to detect botnet traffic by selecting features that distinguish connections belonging to or not belonging to a botnet. By considering the history of network's connections, some clustering algorithms are used to derive a set of rules to decide which should be considered as a botnet. Our main contribution is to evaluate different clustering techniques to detect botnets based on their detection rate (true and false positives). The algorithms used are K-medoids and K-means clustering. Datasets used in this paper were extracted from the repositories ISOT and ISCX. Results on K-medoids were better for almost all the experiments than K-means.

Detection of Botnet Using Flow Analysis and Clustering Algorithm

“…Francisco Villegas Alejandre, Nareli Cruz Cortés, Eleazar Aguirre Anaya, 2016 [15] compared some clustering techniques on their ability to detect botnet traffic by selecting features that distinguish connections belonging to or not belonging to a botnet. It was found that the K-medoids algorithm was better for almost all the experiments than K-means.…”

“…Final cluster centroidsCluster 0:This cluster is purely in majority with 71% of the points lying in cluster 0. Cluster 0 mainly uses the TCP protocol and has an average length of 76 15. units.…”