Hybrid Botnet Detection Based on Host and Network Analysis

Abstract

Botnet is one of the most dangerous cyber-security issues. The botnet infects unprotected machines and keeps track of the communication with the command and control server to send and receive malicious commands. The attacker uses botnet to initiate dangerous attacks such as DDoS, fishing, data stealing, and spamming. The size of the botnet is usually very large, and millions of infected hosts may belong to it. In this paper, we addressed the problem of botnet detection based on network’s flows records and activities in the host. Thus, we propose a general technique capable of detecting new botnets in early phase. Our technique is implemented in both sides: host side and network side. The botnet communication traffic we are interested in includes HTTP, P2P, IRC, and DNS using IP fluxing. HANABot algorithm is proposed to preprocess and extract features to distinguish the botnet behavior from the legitimate behavior. We evaluate our solution using a collection of real datasets (malicious and legitimate). Our experiment shows a high level of accuracy and a low false positive rate. Furthermore, a comparison between some existing approaches was given, focusing on specific features and performance. The proposed technique outperforms some of the presented approaches in terms of accurately detecting botnet flow records within Netflow traces.

Using Ensemble Learning Technique for Detecting Botnet on IoT

“…[9] NB, BN, & DT 98.00 [10] Not ML method 99.00 [11] ANN, SVM, k-NN, NB, & GBM 97.00 [12] k-NN, DT, & RF 70.00 [13] ANN, SVM, NB, DT, RF, LR. & BNet 99.47 [14] NB & DT 97.00 [15] DT 99.00 [16] K-means 82.10 [17] DT 97.00 [18] RF 86.41 [19] ANN, SVM, & NB 93.90 [44] Not ML method 99.82 [20] k-NN & RF 91.10 [21] ANN 97.87 [22] DT 90.40 [23] DT 99.46 [24] ANN, SVM, & k-NN 99.00 [45] Not ML method 95.50 [46] Not ML method 99.68 [25] SVM & ANN 94.00 [47] Not ML method 99.70 [26] DT & ANN 99.20 [48] Not ML method 99.00 [27] KNN, SVM, DT, RF, & ANN 99.00 [28] SVM 99.15 [29] k-NN 94.00 [49] Not ML method 96.20 [50] Not ML method 99.35 [51] Not ML method 92.92 [52] Not ML method 98.70 [53] Not ML method 97.00 [54] Not ML method 98.70 [55] Not ML method *100 [56] Not ML method 99.94 [57] Not ML method 99.60 [58] Not ML method 98.60 [59] Not ML method 97.20 [30] k-NN, NB, DT, RF, & SVM 91.80 [31] ANN 99.60 This research LR, LR, DT, NB, k-NN, RF, GBM, SVM, K-means, K-medians, mini batch, HC, ANN, DBSCAN, GMM, LAC, AP, and ensemble learning…”

Survey on Botnet Detection Techniques: Classification, Methods, and Evaluation

“…Multidimensional refers to the combination of multiple detection objects, mainly referring to the combination of network traffic and signature detection. e literature [113] proposed a hybrid botnet detection method HANABot based on a host-side and network analysis; this is a general technology that can detect new botnets in the early stage. e system contains three components: network analysis component, host analysis component, and a test report.…”

A Survey on Botnets: Incentives, Evolution, Detection and Current Trends

“…The paper primarily focuses on comparison to principal component analysis (PCA) and shows that Lanczos method achieves similar results with a 25% reduction in runtime compared to similar approaches. Reference [186] proposes a multi-faceted detection mechanism based on both host and network analysis. The network analysis is based on known botnet behaviour while host analysis is based on the expected host processes and behaviour.…”