Leveraging Image Representation of Network Traffic Data and Transfer Learning in Botnet Detection

Abstract

The advancements in the Internet has enabled connecting more devices into this technology every day. The emergence of the Internet of Things has aggregated this growth. Lack of security in an IoT world makes these devices hot targets for cyber criminals to perform their malicious actions. One of these actions is the Botnet attack, which is one of the main destructive threats that has been evolving since 2003 into different forms. This attack is a serious threat to the security and privacy of information. Its scalability, structure, strength, and strategy are also under successive development, and that it has survived for decades. A bot is defined as a software application that executes a number of automated tasks (simple but structurally repetitive) over the Internet. Several bots make a botnet that infects a number of devices and communicates with their controller called the botmaster to get their instructions. A botnet executes tasks with a rate that would be impossible to be done by a human being. Nowadays, the activities of bots are concealed in between the normal web flows and occupy more than half of all web traffic. The largest use of bots is in web spidering (web crawler), in which an automated script fetches, analyzes, and files information from web servers. They also contribute to other attacks, such as distributed denial of service (DDoS), SPAM, identity theft, phishing, and espionage. A number of botnet detection techniques have been proposed, such as honeynet-based and Intrusion Detection System (IDS)-based. These techniques are not effective anymore due to the constant update of the bots and their evasion mechanisms. Recently, botnet detection techniques based upon machine/deep learning have been proposed that are more capable in comparison to their previously mentioned counterparts. In this work, we propose a deep learning-based engine for botnet detection to be utilized in the IoT and the wearable devices. In this system, the normal and botnet network traffic data are transformed into image before being given into a deep convolutional neural network, named DenseNet with and without considering transfer learning. The system is implemented using Python programming language and the CTU-13 Dataset is used for evaluation in one study. According to our simulation results, using transfer learning can improve the accuracy from 33.41% up to 99.98%. In addition, two other classifiers of Support Vector Machine (SVM) and logistic regression have been used. They showed an accuracy of 83.15% and 78.56%, respectively. In another study, we evaluate our system by an in-house live normal dataset and a solely botnet dataset. Similarly, the system performed very well in data classification in these studies. To examine the capability of our system for real-time applications, we measure the system training and testing times. According to our examination, it takes 0.004868 milliseconds to process each packet from the network traffic data during testing.

Deep Learning for Cyber Security Applications: A Comprehensive Survey

“…Convolutional Neural Network: A CNN based botnet detection framework for IoT and wearable devices where the network traffic data was converted into image format was trained using CTU-13 Dataset. It achieved the best case accu-racy of 99.98% while SVM and logistic regression achieved accuracies of 83.15% and 78.56% respectively [253].…”

A Survey on Botnets: Incentives, Evolution, Detection and Current Trends

“…Best accuracy of ResNet is 99.32%. Reference [95] 99.98% accuracy for DenseNet and 83.15% for SVM. Reference [96] achieves up to 98.6% botnet detection accuracy on the self-tests and about 90% on the cross-evaluation test.…”

“…Reference [94]: Training process requires GPU power. Reference [95] does not yet support transfer learning.…”

“…Deep learning, which employs neural networks, has been used by Taheri et al [95], who proposes a deep learning-based botnet detection engine that takes raw network traffic data as input and transforms them into images. These images are then input into a deep convolutional neural network (CNN), DenseNet, for classification of normal and botnet traffic data.…”

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

“…The models are evaluated using real-world malware dataset containing 34,000,000 unique malware samples and the best model achieves a true positive rate 99.86. In [575], a CNN based botnet detection framework for IoT and wearable devices is proposed where the model is trained using CTU-13 Dataset. The network traffic data is converted into image format and fed into CNN model.…”