2021
DOI: 10.1109/access.2021.3108222
|View full text |Cite
|
Sign up to set email alerts
|

Efficient Detection of Botnet Traffic by Features Selection and Decision Trees

Abstract: Botnets are one of the online threats with the most significant presence, causing billionaire losses to global economies. Nowadays, the increasing number of devices connected to the Internet makes it necessary to analyze extensive network traffic data. In this work, we focus on increasing the performance of botnet traffic classification by selecting those features that further increase the detection rate. For this purpose, we use two feature selection techniques, i.e., Information Gain and Gini Importance, whi… Show more

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...
1
1
1
1

Citation Types

0
15
0
1

Year Published

2022
2022
2024
2024

Publication Types

Select...
4
4

Relationship

1
7

Authors

Journals

citations
Cited by 38 publications
(16 citation statements)
references
References 51 publications
0
15
0
1
Order By: Relevance
“…Next, the second module performs the classification using these features. Following the above-mentioned time restriction, we chose the classifier Decision Tree (DT), since it is fast in the decision 17 , and because it is possible to quickly train a new DT with traffic traces of new or modified botnets.…”
Section: Methodsmentioning
confidence: 99%
See 1 more Smart Citation
“…Next, the second module performs the classification using these features. Following the above-mentioned time restriction, we chose the classifier Decision Tree (DT), since it is fast in the decision 17 , and because it is possible to quickly train a new DT with traffic traces of new or modified botnets.…”
Section: Methodsmentioning
confidence: 99%
“…As the classifier for our approach, we selected a Decision Tree, following the results of our previous work 17 , in which we compared the computational costs of four different models -Decision Tree (DT), Random Forest (RF), k-Nearest Neighbors (kNN) and Support Vector Machines (SVM)-, and realized that DT was the most efficient among them. Finally, we compared our model to other three state-of-the-art approaches that could also be implemented to use time windows of one second, and we assessed that our approach was an order of magnitude faster.…”
mentioning
confidence: 99%
“…Velasco-Mata et al [40] has tested the feature sets of 5, 6, 7 with two filter methods, Information Gain and Gini Importance, over Decistion Tree, Random Forest, k-NN for botnet detection for multi class classification. Finally, the five feature set produced an 85% detection rate with a decision tree classifier on the QB-CTU13 [41] and EQB-CTU13 [41] datasets.…”
Section: B Feature Selectionmentioning
confidence: 99%
“…We have experimented with all tasks with the same CPU. Finally,To measure the performance of a features set of features which are derived by Filter and wrapper methods, We computed the ratio of the F1-score and the computational time to permit the measurement of the gain in detection ability regarding the computational expense of this detection [40].…”
Section: Application Of the Machine Learning Workflowmentioning
confidence: 99%
“…e proposed method has shown how it can perform against both normal attack data and botnet-specific attack data. Javier et al [25] focus on the method to increase the performance of botnet traffic classification. ey use Information Gain and Gini Importance to select features and evaluate the selected features through performing three models, that is, Decision Tree, Random Forest, and k-Nearest Neighbor.…”
Section: Related Workmentioning
confidence: 99%