Botnet Detection Using Graphical Lasso with Graph Density

Abstract

A botnet detection method using the graphical lasso is studied. Hamasaki et al. proposed a botnet detection method based on graphical lasso applied on darknet traffic, which captures change points of outputs of graphical lasso caused by a botnet activity. In their method, they estimate cooperative relationship of bots using graphical lasso. If the regularization coefficient of graphical lasso is appropriately tuned, it can remove false cooperative relationships to some extent. Though they represent the cooperative relationships of bots as a graph, they didn’t use its graphical properties. We propose a new method of botnet detection based on ‘graph density’, for which we introduce a new method to set the regularization coefficient automatically. The effectiveness of the proposed method is illustrated by experiments on darknet data.