Botnet detection using ensemble classifiers of network flow

Algelal, Zahraa M.; Aldhaher, Eman Abdulaziz Ghani; Abdul-Wadood, Dalia N.; AL-Sagheer, Radhwan Hussein Abdulzhraa

doi:10.11591/ijece.v10i3.pp2543-2550

Cited by 12 publications

(10 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The process of automatically or manually selecting the features that contribute the most to the prediction variable or output in which you are interested is known as feature selection. Irrelevant features in a dataset may reduce model accuracy and lead the model to train on irrelevant features [32]. There are several advantages to selecting features before modeling data [33], including:…”

Section: Feature Selectionmentioning

confidence: 99%

BotSward: Centrality Measures for Graph-Based Bot Detection Using Machine Learning

Shinan¹,

Alsubhi²,

Ashraf³

2023

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

The number of botnet malware attacks on Internet devices has grown at an equivalent rate to the number of Internet devices that are connected to the Internet. Bot detection using machine learning (ML) with flow-based features has been extensively studied in the literature. Existing flow-based detection methods involve significant computational overhead that does not completely capture network communication patterns that might reveal other features of malicious hosts. Recently, Graph-Based Bot Detection methods using ML have gained attention to overcome these limitations, as graphs provide a real representation of network communications. The purpose of this study is to build a botnet malware detection system utilizing centrality measures for graph-based botnet detection and ML. We propose BotSward, a graph-based bot detection system that is based on ML. We apply the efficient centrality measures, which are Closeness Centrality (CC), Degree Centrality (CC), and PageRank (PR), and compare them with others used in the state-of-the-art. The efficiency of the proposed method is verified on the available Czech Technical University 13 dataset (CTU-13). The CTU-13 dataset contains 13 real botnet traffic scenarios that are connected to a command-and-control (C&C) channel and that cause malicious actions such as phishing, distributed denial-of-service (DDoS) attacks, spam attacks, etc. BotSward is robust to zero-day attacks, suitable for large-scale datasets, and is intended to produce better accuracy than state-of-the-art techniques. The proposed BotSward solution achieved 99% accuracy in botnet attack detection with a false positive rate as low as 0.0001%.

show abstract

Section: Feature Selectionmentioning

confidence: 99%

BotSward: Centrality Measures for Graph-Based Bot Detection Using Machine Learning

Shinan¹,

Alsubhi²,

Ashraf³

2023

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

show abstract

“…Many researchers tried with various ensemble algorithms to compare and examine how well they could separate botnet activity from regular traffic by picking out distinctive characteristics of the network traffic. According to experimental findings, machine learning approaches are capable of efficiently detecting numerous invasions [62], [63]. Different techniques were also analyzed using machine learning by Khammas [64] and Sonker and Gupta [65] in 2021 to detect ransomware viruses, where the results showed a detection accuracy of 98%.…”

Section: Figure 2 Overview Of Grey Hole Attack [19]mentioning

confidence: 99%

Malicious attacks modelling: a prevention approach for ad hoc network security

Talib

Alothman

Mohammed

2023

IJEECS

View full text Add to dashboard Cite

As a result of the expansions that have taken place in the field of networking and the increase in the number of users of networks, there have recently been breakthroughs made in the techniques and methods used for network security. In this paper, a virtual private network (VPN) is proposed as a means of providing the necessary level of security for particular connections that span across vast networks. After the network performance metrics such as time delay and throughput have been accomplished, the suggested VPN is recommended for the purpose of assuring network security. In addition, artificial intelligence attack predictors and virtual private networks have been implemented with the purpose of preventing harmful activity within such connections. Using a wide variety of machine learning methods like Random Forests and Nave Bays, malicious assaults of any kind can be identified and thwarted in their tracks. Another technique for anticipating attacks is the use of an artificial neural network, which is a type of system that engages in deep learning and learns the behaviors of attacks while it is being trained so that it can then predict attacks. The results of this study demonstrate that the use of machine learning and artificial intelligence techniques can significantly improve the security and performance of virtual private networks and can effectively identify and prevent malicious attacks on networks.

show abstract

“…In this paper, we will not only evaluate features to select important features but also evaluate the anomaly detection model based on the feature evaluation process. The study [20] proposed the Information gain method to reduce the feature dimension in the training process of the botnet detection model. However, in that study, the authors didn't specify which redundant features were removed.…”

Section: The Problem Of Optimizing the Anomaly Detection Feature On The Network Based On The Unsw-nb15 Datasetmentioning

confidence: 99%

Optimization of network traffic anomaly detection using machine learning

Dam

Lam

2021

IJECE

View full text Add to dashboard Cite

In this paper, to optimize the process of detecting cyber-attacks, we choose to propose 2 main optimization solutions: Optimizing the detection method and optimizing features. Both of these two optimization solutions are to ensure the aim is to increase accuracy and reduce the time for analysis and detection. Accordingly, for the detection method, we recommend using the Random Forest supervised classification algorithm. The experimental results in section 4.1 have proven that our proposal that use the Random Forest algorithm for abnormal behavior detection is completely correct because the results of this algorithm are much better than some other detection algorithms on all measures. For the feature optimization solution, we propose to use some data dimensional reduction techniques such as information gain, principal component analysis, and correlation coefficient method. The results of the research proposed in our paper have proven that to optimize the cyber-attack detection process, it is not necessary to use advanced algorithms with complex and cumbersome computational requirements, it must depend on the monitoring data for selecting the reasonable feature extraction and optimization algorithm as well as the appropriate attack classification and detection algorithms.

show abstract

Botnet detection using ensemble classifiers of network flow

Cited by 12 publications

References 28 publications

BotSward: Centrality Measures for Graph-Based Bot Detection Using Machine Learning

BotSward: Centrality Measures for Graph-Based Bot Detection Using Machine Learning

Malicious attacks modelling: a prevention approach for ad hoc network security

Optimization of network traffic anomaly detection using machine learning

Contact Info

Product

Resources

About