DETECTION OF BOTNET COMMUNICATION OVER TCP NETWORK FLOW USING MACHINE LEARNING ALGORITHMS

Abstract

Ponte Academic JournalJun 2021, Volume 77, Issue 6 DETECTION OF BOTNET COMMUNICATION OVER TCP NETWORK FLOW USING MACHINE LEARNING ALGORITHMSAuthor(s): Ali Haydar Eser ,Zafer Aslan, Ali Gunes, Metin ZontulJ. Ponte - Jun 2021 - Volume 77 - Issue 6 doi: 10.21506/j.ponte.2021.6.2 Abstract:One of the greatest challenges in the cybersecurity is the detection of botnets. In recent decades, a wide range of machine learning techniques has been utilized for this purpose. Nevertheless, rapidly evolving cyber-threats keep finding novel ways to bypass cyber defense systems. Botnets can use many different network protocols such as UDP, ICMP and TCP for malicious communication. Since TCP is one of the most commonly used network protocols, it is of particular importance. Therefore, this study focuses on the detection of the botnets communicating over TCP only. A labeled dataset with botnet, normal and background traffic named CTU-13 is used for training 3 different machine learning algorithms (k-NN, Random Forest, LightGBM) for botnet traffic classification and testing the success of the proposed botnet detection model. Based on the expert knowledge and using a correlation filter, 3 flow features are deliberately selected among the 14 different network flow features included in CTU-13 database. The proposed model can efficiently distinguish botnet traffic from normal traffic with 94.26% accuracy by using LightGBM classifier without being caught in the overfitting trap contrary to the most classification models in the literature featuring ip-based approaches. Download full text:Check if you have access through your login credentials or your institution Username Password