Detecting botnet by using particle swarm optimization algorithm based on voting system

In smart systems, attackers can use botnets to launch different cyber attack activities against the Internet of Things. The traditional methods of detecting botnets commonly used machine learning algorithms, and it is difficult to detect and control botnets in a network because of unbalanced traffic data. In this article, we present a novel and highly efficient botnet detection method based on an autoencoder neural network in cooperation with decision trees on a given network. The deep flow inspection method and statistical analysis are first applied as a feature selection technique to select relevant features, which are used to characterize the communication-related behavior between network nodes. Then, the autoencoder neural network for feature selection is used to improve the efficiency of model construction. Finally, Tomek-Recursion Borderline Synthetic Minority Oversampling Technique generates additional minority samples to achieve class balance, and an improved gradient boosting decision tree algorithm is used to train and establish an abnormal traffic detection model to improve the detection of unbalanced botnet data. The results of experiments on the ISCX-botnet traffic dataset show that the proposed method achieved better botnet detection performance with 99.10% recall, 99.20% accuracy, 99.1% F1 score, and 99.0% area under the curve.

https://journals.sagepub.com/doi/pdf/10.1177/15501477211049910

A novel and highly efficient botnet detection algorithm based on network traffic analysis of smart systems

Abstract Botnets are one of the most harmful cyberthreats, that can perform many types of cyberattacks and cause billionaire losses to the global economy. Nowadays, vast amounts of network traffic are generated every second, hence manual analysis is impossible. To be effective, automatic botnet detection should be done as fast as possible, but carrying this out is difficult in large bandwidths. To handle this problem, we propose an approach that is capable of carrying out an ultra-fast network analysis (i.e. on windows of one second), without a significant loss in the F1-score. We compared our model with other three literature proposals, and achieved the best performance: an F1 score of 0.926 with a processing time of 0.007 ms per sample. We also assessed the robustness of our model on saturated networks and on large bandwidths. In particular, our model is capable of working on networks with a saturation of 10% of packet loss, and we estimated the number of CPU cores needed to analyze traffic on three bandwidth sizes. Our results suggest that using commercial-grade cores of 2.4 GHz, our approach would only need four cores for bandwidths of 100 Mbps and 1 Gbps, and 19 cores on 10 Gbps networks. 

/pdf/real-time-botnet-detection-on-large-network-bandwidths-using-24386ru9.pdf

Real-time botnet detection on large network bandwidths using machine learning

The internet’s technological advancements exposed the globe to its weaknesses as well. The risk of exploitation has also increased as a result of larger network cores cooperating to combat cyber threats, which continue to be a severe problem for the entire world. Recurrent Neural Networks (RNN)-based deep learning techniques have recently advanced to new levels in a variety of fields and applications. The risk of forged accounts is greater than ever thanks to increased network use and traffic. The challenge to identify a malicious host on the internet has always been a challenge from the development perspective. The job of binary classification to label a host as a botnet has not made any significant progress and thus still, the internet faces the issue of botnets taking over many active and important connections exploiting the network, controlling compromised hosts to spam other hosts on the network, launch DDoS attacks and more. This paper attempts to provide a novel approach for evolving the comprehensive framework for controlling botnet host prediction and uses them to handle real time cases. To attain greater recognition accuracy, we use Gated Recurrent Unit (GRU) as a hybrid Recurrent Neural Network (RNN) model. We take an evolving time series input from a network station for several days which depicts data flow i.e., count of connections from different devices recognized by their IPs, and these features are used from the IP flow to provide capability to recognize the host on a network as a potential threat. Threat detection of such botnets is important not only from the perspective of stopping them but also to find significant insights about the targeted attack to understand future trends and make the networks persistent against them.

Data driven approach to identify a flow-based Botnet Host using Deep Learning

A botnet is a network of infected bots that works independently under the control of a Botmaster, which issues commands to bots using command and control server. Over time botnet architectures have been become advanced to evade the detection and disruption. Botnets are used by cybercriminal attackers for performing an unwanted activity for personal advantages like performing DDOS attack, theft of bank related information like id, password, and other harmful activities through the network, which might be a great loss for the society. In this paper, a supervised machine learning classification is used to classify the flow based botnet traffic using network flow dataset. The proposed model is able to distinguish botnet traffic from normal traffic with an accuracy of 99.94% using the J48 decision tree machine learning algorithm. The result of the proposed algorithm is efficient to be implemented in real time scenario.

Flow Based Botnet Traffic Detection Using Machine Learning

Handwritten digit recognition (reading by computer) is a process that gives the technological capabilities to a system to recognize handwritten numerals using Machine Learning. It is very tough to recognize handwritten characters because of the non-similarity in characters by different people. Also, there exists no standard technique available in the industry which can be applicable to provide innovative solutions to all kinds of handwritten characters. Hence, there is a requirement to understand the nature of the script. In order to complete the task, there is a need to use unique extraction methods and a classifier. This work implements a Histogram of Oriented Gradient (HOG) features with Support Vector Machine (SVM) classifier and a Hopfield model to recognize handwritten Bengali numerals into the class of ten segments. SVM works in the way of mapping the input elements to a set of the high-dimensional feature vector. This works both in the case of linearly and nonlinearly and separable data. The experiments have been done using 1200 handwritten digits for 10 different classes (0 to 9). The overall accuracy (productivity) obtained from the implementation is 89.5%. The experimental outcomes from the Hopfield model give an accuracy of 95.5%. Also, it is found the Hopfield model is more capable of handling noisy inputs.

Parul Gahelot

Papers

Flow Based Botnet Traffic Detection Using Machine Learning

Hog Features Based Handwritten Bengali Numerals Recognition Using SVM Classifier: A Comparison with Hopfield Implementation