Real time botnet detection system based on machine learning algorithms

Abstract

Studies towards botnet activity detection methods have become a major focus over the years since many concerns have been raised due to botnets. The detection against Domain Name System (DNS) queries, which bots widely used for their connection with the Command&Control (C&C) server, was considered the main method of botnet prevention. However, this method does not apply to Domain Generation Algorithm (DGA)-based botnets, which dynamically generate a large number of Non-existent domains, combined with fast flux. The approach of using machine learning in which the models are trained to study the characteristics of DGA domains is thought to be more effective than the methods that rely solely on a set of fixed rules. For such reasons, this paper will explore a novel method of botnet detection using machine learning. The effectiveness of this method is to be assessed in a system we designed for botnet detection, fed with truth marked dataset. The results indicate a high performance of our method with 95.3% in accuracy and a 5.4% false positive rate (FPR).