On the use of machine learning for identifying botnet network traffic

Abstract

During the last decade significant scientific efforts have been invested in the development of methods that could provide efficient and effective botnet detection. As a result, an array of detection methods based on diverse technical principles and targeting various aspects of botnet phenomena have been defined. As botnets rely on the Internet for both communicating with the attacker as well as for implementing different attack campaigns, network traffic analysis is one of the main means of identifying their existence. In addition to relying on traffic analysis for botnet detection, many contemporary approaches use machine learning techniques for identifying malicious traffic. This paper presents a survey of contemporary botnet detection methods that rely on machine learning for identifying botnet network traffic. The paper provides a comprehensive overview on the existing scientific work thus contributing to the better understanding of capabilities, limitations and opportunities of using machine learning for identifying botnet traffic. Furthermore, the paper outlines possibilities for the future development of machine learning-based botnet detection systems.

Botnets and Methods of Their Detection

“…Obviously, network-based methods aimed at detecting more bots should handle a large volume of data [19].…”

Parameter Identification of an MEMS Vibratory Gyroscope with Hyperstability Theory

“…Botnet detection method based on features [3,4] , according to the characteristics of communication data, the attack data stream can be quickly detected, but it is helpless to the attack with unknown features. Because the communication data stream of botnet is scarce, how to extract features is also a difficult problem.…”

A self‐learning stream classifier for flow‐based botnet detection

“…1,2 A botnet is a coordinated group of infected bots that receive orders from an attacker (ie, botmaster), via various command and control (C&C) channels. [5][6][7] One of the main challenges in such systems is making a proper decision for new and unseen events. 4 In the last few years, a number of methods have been proposed to detect different types of botnets.…”