Botnet Dataset Overview Using Statistical Approach Based on Time Gap Activity Analysis

Abstract

Botnet malware is a malicious activity that needs to be detected accurately. Several botnet detection models have been introduced using a mining-based method. The distribution analysis approach is often used to obtain the characteristics of the data before modeling it on a mining-based detection model. However, the distribution approach could be more optimal in describing the timeliness of botnet attacks. The botnet attack time analysis is needed to determine the right detection model for the botnet activity detection model. This paper proposes a new overview technique for botnet datasets using a statistical approach based on time gap analysis for each bot. The goal is to obtain a threshold value that can optimally separate botnet activity traffic from normal traffic. The experimental result is three different time gap threshold values to separate the botnet, normal, and background activity, ideally based on the highest time of 4,756 s, the lowest time of 28.69 s, and the average maximum time gap of 810.61 s.