@misc{10481/68044,
year = {2021},
month = {2},
url = {http://hdl.handle.net/10481/68044},
abstract = {A botnet is a malware program that a hacker remotely controls called a botmaster. Botnet
can perform massive cyber-attacks such as DDOS, SPAM, click-fraud, information, and identity stealing.
The botnet also can avoid being detected by a security system. The traditional method of detecting botnets
commonly used signature-based analysis unable to detect unseen botnets. The behavior-based analysis seems
like a promising solution to the current trends of botnets that keep evolving. This paper proposes a multilayer
framework for botnet detection using machine learning algorithms that consist of a  ltering module and
classi cation module to detect the botnet's command and control server. We highlighted several criteria for
our framework, such as it must be structure-independent, protocol-independent, and able to detect botnet
in encapsulated technique. We used behavior-based analysis through  ow-based features that analyzed
the packet header by aggregating it to a 1-s time. This type of analysis enables detection if the packet is
encapsulated, such as using a VPN tunnel. We also extend the experiment using different time intervals, but
a 1-s time interval shows the most impressive results. The result shows that our botnet detection method can
detect up to 92% of the f-score, and the lowest false-negative rate was 1.5%.},
organization = {Universiti Teknologi Malaysia (UTM) through the Research University 

Vot-20H04},
organization = {Malaysia Research University Network (MRUN) 

Vot4L876},
organization = {Ministry of Higher Education through the Fundamental Research Grant Scheme 

FRGS/1/2018/ICT04/UTM/01/1},
organization = {Hadiah Latihan Persekutuan (HLP) Scholarship through the Ministry of Education Malaysia},
organization = {Specific Research Project (SPEV) by the Faculty of Informatics and Management, University of Hradec Kralove, Czech Republic},
publisher = {IEEE (Institute of Electrical and Electronics Engineers)},
keywords = {Behavior-based analysis},
keywords = {Botnet},
keywords = {Flow-based feature selection},
keywords = {K-nearest neighbor},
keywords = {Structure independent},
title = {Multilayer framework for botnet detection using machine learning algorithms},
doi = {10.1109/ACCESS.2021.3060778},
author = {Ibrahim, Wan Nur Hidayah and Herrera Viedma, Enrique},
}