Deep Learning Techniques for Android Botnet Detection

Yerima, Suleiman Y.; Alzaylaee, Mohammed K.; Shajan, Annette; Vinod, P.

doi:10.3390/electronics10040519

Cited by 44 publications

(19 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They presented an approach called smart adaptive particle swarm optimization support vector machine (SAPSO-SVM) based on the top 20 traffic features from the 28-SABD Android botnet dataset. In [17], 342 static features consisting of permissions, intents, extra executable files, API calls, and commands were used in conjunction with deep learning classifiers such as CNN-LSTM, LSTM, GRU and DNN. This study was also based on the 1929 ISCX botnet samples with additional 4873 clean samples.…”

Section: Related Workmentioning

confidence: 99%

“…understanding permission protection levels). Moreover, our proposed system requires less feature extraction effort compared to the more manual systems presented in [12], [13], [17], [18], [19] and [26] for example. In section III, we describe the proposed system in greater detail.…”

Section: Related Workmentioning

confidence: 99%

“…The dataset consists of 1929 botnet samples from 14 families. The dataset is originally from [6] and has been utilized in several previous works such as [10], [11], [14], [15], [17], [18] and [19]. In order to build and evaluate the proposed models via supervised learning, we obtained an additional 1929 benign samples to give a balanced dataset consisting of a total of 3858 Android app samples.…”

Section: A Datasetmentioning

confidence: 99%

See 2 more Smart Citations

A deep learning-enhanced botnet detection system based on Android manifest text mining

Yerima

2022

2022 10th International Symposium on Digital Forensics and Security (ISDFS)

Self Cite

View full text Add to dashboard Cite

Android botnets remain a significant threat to mobile and IoT systems and networks as they continue to infect millions of devices worldwide. Therefore, there is a need to develop more effective solutions to tackle their spread. Hence, in this paper we propose a system for detecting Android botnets through automated text mining of the manifest files obtained from apps. The proposed method utilizes NLP techniques to extract features from the manifest files and a deep learning-based classification model is used to detect botnet applications. The classification model is implemented using CNN and a traditional machine learning classifier such as SVM, Random Forest or KNN. We performed experiments to evaluate the proposed system with 3858 Android applications consisting of 1929 botnet and 1929 benign samples. The results showed the best overall performance with the CNN-SVM hybrid model which had an average accuracy of 96.9% thus outperforming the singular machine learning classifiers.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: A Datasetmentioning

confidence: 99%

See 1 more Smart Citation

A deep learning-enhanced botnet detection system based on Android manifest text mining

Yerima

2022

2022 10th International Symposium on Digital Forensics and Security (ISDFS)

Self Cite

View full text Add to dashboard Cite

show abstract

“…Botnets pose a threat to network security because they are used in cybercrime techniques such as distributed denial of service (DDoS). Machine learning algorithms are used to track such attacks in IoT [20][21][22]. A botnet can be used to refuse services directed and distributed to any system on the internet so that it cannot properly serve its legitimate customers.…”

Section: Introductionmentioning

confidence: 99%

Hybrid deep-learning model to detect botnet attacks over internet of things environments

Alzahrani

Bamhdi

2022

Soft Comput

View full text Add to dashboard Cite

In recent years, the use of the internet of things (IoT) has increased dramatically, and cybersecurity concerns have grown in tandem. Cybersecurity has become a major challenge for institutions and companies of all sizes, with the spread of threats growing in number and developing at a rapid pace. Artificial intelligence (AI) in cybersecurity can to a large extent help face the challenge, since it provides a powerful framework and coordinates that allow organisations to stay one step ahead of sophisticated cyber threats. AI provides real-time feedback, helping rollover daily alerts to be investigated and analysed, effective decisions to be made and enabling quick responses. AI-based capabilities make attack detection, security and mitigation more accurate for intelligence gathering and analysis, and they enable proactive protective countermeasures to be taken to overwhelm attacks. In this study, we propose a robust system specifically to help detect botnet attacks of IoT devices. This was done by innovatively combining the model of a convolutional neural network with a long short-term memory algorithm mechanism to detect two common and serious IoT attacks (BASHLITE and Mirai) on four types of security camera. The data sets, which contained normal malicious network packets, were collected from real-time lab-connected camera devices in IoT environments. The results of the experiment showed that the proposed system achieved optimal performance, according to evaluation metrics. The proposed system gave the following weighted average results for detecting the botnet on the Provision PT-737E camera: camera precision: 88%, recall: 87% and F1 score: 83%. The results of system for classifying botnet attacks and normal packets on the Provision PT-838 camera were 89% for recall, 85% for F1 score and 94%, precision. The intelligent security system using the advanced deep learning model was successful for detecting botnet attacks that infected camera devices connected to IoT applications.

show abstract

“…Botnet-based DDoS attacks are devastating for the target network as they will drain all network bandwidth and victim computer resources and cause an interruption of services. Machine learning methods are now commonly used to track these attacks in IoT [20][21][22].…”

Section: Introductionmentioning

confidence: 99%

Botnet Attack Detection Using Local Global Best Bat Algorithm for Industrial Internet of Things

et al. 2021

View full text Add to dashboard Cite

The need for timely identification of Distributed Denial-of-Service (DDoS) attacks in the Internet of Things (IoT) has become critical in minimizing security risks as the number of IoT devices deployed rapidly grows globally and the volume of such attacks rises to unprecedented levels. Instant detection facilitates network security by speeding up warning and disconnection from the network of infected IoT devices, thereby preventing the botnet from propagating and thereby stopping additional attacks. Several methods have been developed for detecting botnet attacks, such as Swarm Intelligence (SI) and Evolutionary Computing (EC)-based algorithms. In this study, we propose a Local-Global best Bat Algorithm for Neural Networks (LGBA-NN) to select both feature subsets and hyperparameters for efficient detection of botnet attacks, inferred from 9 commercial IoT devices infected by two botnets: Gafgyt and Mirai. The proposed Bat Algorithm (BA) adopted the local-global best-based inertia weight to update the bat’s velocity in the swarm. To tackle with swarm diversity of BA, we proposed Gaussian distribution used in the population initialization. Furthermore, the local search mechanism was followed by the Gaussian density function and local-global best function to achieve better exploration during each generation. Enhanced BA was further employed for neural network hyperparameter tuning and weight optimization to classify ten different botnet attacks with an additional one benign target class. The proposed LGBA-NN algorithm was tested on an N-BaIoT data set with extensive real traffic data with benign and malicious target classes. The performance of LGBA-NN was compared with several recent advanced approaches such as weight optimization using Particle Swarm Optimization (PSO-NN) and BA-NN. The experimental results revealed the superiority of LGBA-NN with 90% accuracy over other variants, i.e., BA-NN (85.5% accuracy) and PSO-NN (85.2% accuracy) in multi-class botnet attack detection.

show abstract

Deep Learning Techniques for Android Botnet Detection

Cited by 44 publications

References 20 publications

A deep learning-enhanced botnet detection system based on Android manifest text mining

A deep learning-enhanced botnet detection system based on Android manifest text mining

Hybrid deep-learning model to detect botnet attacks over internet of things environments

Botnet Attack Detection Using Local Global Best Bat Algorithm for Industrial Internet of Things

Contact Info

Product

Resources

About