Multilayer framework for botnet detection using machine learning algorithms
MetadataShow full item record
IEEE (Institute of Electrical and Electronics Engineers)
Behavior-based analysisBotnetFlow-based feature selectionK-nearest neighborStructure independent
W. N. H. Ibrahim et al., "Multilayer Framework for Botnet Detection Using Machine Learning Algorithms," in IEEE Access, vol. 9, pp. 48753-48768, 2021, [doi:10.1109/ACCESS.2021.3060778]
SponsorshipUniversiti Teknologi Malaysia (UTM) through the Research University Vot-20H04; Malaysia Research University Network (MRUN) Vot4L876; Ministry of Higher Education through the Fundamental Research Grant Scheme FRGS/1/2018/ICT04/UTM/01/1; Hadiah Latihan Persekutuan (HLP) Scholarship through the Ministry of Education Malaysia; Specific Research Project (SPEV) by the Faculty of Informatics and Management, University of Hradec Kralove, Czech Republic
A botnet is a malware program that a hacker remotely controls called a botmaster. Botnet can perform massive cyber-attacks such as DDOS, SPAM, click-fraud, information, and identity stealing. The botnet also can avoid being detected by a security system. The traditional method of detecting botnets commonly used signature-based analysis unable to detect unseen botnets. The behavior-based analysis seems like a promising solution to the current trends of botnets that keep evolving. This paper proposes a multilayer framework for botnet detection using machine learning algorithms that consist of a ltering module and classi cation module to detect the botnet's command and control server. We highlighted several criteria for our framework, such as it must be structure-independent, protocol-independent, and able to detect botnet in encapsulated technique. We used behavior-based analysis through ow-based features that analyzed the packet header by aggregating it to a 1-s time. This type of analysis enables detection if the packet is encapsulated, such as using a VPN tunnel. We also extend the experiment using different time intervals, but a 1-s time interval shows the most impressive results. The result shows that our botnet detection method can detect up to 92% of the f-score, and the lowest false-negative rate was 1.5%.