Botnet Detection Method Research Articles

PeerG: A P2P botnet detection method based on representation learning and graph contrastive learning

P2P botnets are distributed with complex topology and communication behavior, making them harder to detect and remove. Individuals or organizations can effectively detect P2P botnets by analyzing abnormal behaviors in network traffic. Existing works focus on extracting deterministic traffic interaction features, which are highly dependent on statistical features. Moreover, these methods are mainly aimed at generalized botnet detection and lack specificity for detecting P2P botnets. They ignore the topological information of P2P botnets, resulting in unsatisfactory detection accuracy. Among the few existing methods targeting P2P botnets, they consider the topological information but mainly rely on classical graph theory statistical features, such as degree, feature vector centrality, etc. This limits the generalization ability of the detection model. In this paper, we delve into the topological features of P2P botnets from the perspective of complex graph theory. We propose a P2P botnet detection method that combines representation learning and graph contrastive learning, dubbed PeerG. Specifically, we construct the communication graphs based on the flow interaction behavior between components of the P2P botnets. The Line algorithm is employed to embed the nodes of the communication graph into a low-dimensional representation vector space. Subsequently, the graph contrastive learning approach is utilized to optimize the feature extractor, enabling it to capture more representative node features. PeerG serves as a benchmark detection model for identifying P2P botnet nodes. Additionally, we devise two optimized contrastive detection strategies (PeerG-PreG and PeerG-PreF) based on graph-level and feature-level to boost the performance of PeerG. Extensive experiments demonstrate that PeerG brings significant improvements in detection accuracy over state-of-art detection methods. Furthermore, compared with PeerG, the detection strategies PeerG-PreG and PeerG-PreF have further improved detection performance, and achieve the best detection accuracy among multiple filtered P2P botnet types.

Distributed Detection of Large-Scale Internet of Things Botnets Based on Graph Partitioning

With the rapid growth of IoT devices, the threat of botnets is becoming increasingly worrying. There are more and more intelligent detection solutions for botnets that have been proposed with the development of artificial intelligence. However, due to the current lack of computing power in IoT devices, these intelligent methods often cannot be well-applied to IoT devices. Based on the above situation, this paper proposes a distributed botnet detection method based on graph partitioning, efficiently detecting botnets using graph convolutional networks. In order to alleviate the wide range of IoT environments and the limited computing power of IoT devices, the algorithm named METIS is used to divide the network traffic structure graph into small graphs. To ensure robust information flow between nodes while preventing gradient explosion, diagonal enhancement is applied to refine the embedding representations at each layer, facilitating accurate botnet attack detection. Through comparative analysis with GATv2, GraphSAGE, and GCN across the C2, P2P, and Chord datasets, our method demonstrates superior performance in both accuracy and F1 score metrics. Moreover, an exploration into the effects of varying cluster numbers and depths revealed that six cluster levels yielded optimal results on the C2 dataset. This research significantly contributes to mitigating the IoT botnet threat, offering a scalable and effective solution for diverse IoT ecosystems.

Bot-DM: A dual-modal botnet detection method based on the combination of implicit semantic expression and graphical expression

A botnet is a group of hijacked devices that conduct various cyberattacks, which is one of the most dangerous threats on the internet. Individuals or organizations can effectively detect botnets by analyzing abnormal behaviors in network traffic. Existing works focus on extracting the deterministic behavioral features, which highly rely on statistical features and existing botnet interaction structures, resulting in unsatisfactory detection accuracy, especially for unknown botnet traffic. The botnet detection method based on the original traffic bytes has more advantages in this regard, especially the use of mining payload information in the traffic to enhance the identification of abnormal botnet behavior is the focus of this study. In this paper, we propose a dual-mode botnet detection scheme, which takes the original traffic bytes as the object, one is to encode the implicit semantic relationship between the traffic bytes through a multi-layer Transformer encoder, and the other is the network traffic Image representation, the spatial relationship of traffic bytes is captured by a deep neural network, and then botnet detection is achieved by maximizing the mutual information between the two. We conduct comprehensive experiments with both known botnets and unknown botnets to evaluate our scheme. Experimental results show that for known botnets, our approach achieves 99.84% and 91.92% detection accuracy with CTU-13 and ISCX-2014 datasets, respectively, which is 3.04% and 2.54% more accurate compared with the state-of-art (DL). For unknown datasets, our scheme is 10.19% more accurate than the existing traffic representation.

The technology of ensuring cyber security of the cloud environment based on the Cisco Cloudlock solution

The article examines Denial of Service (DDoS) attacks that occur at the network layer of IoT systems and their impact on various aspects of network operation. DDoS attack scenarios using network bandwidth and using system resources are briefly discussed. Botnet detection methods in the IoT network are analyzed.

Central Pivot Heuristics for Botnet Attack Defense in Iot

Botnet assaults on IoT systems have become a big issue, and several strategies for botnet protection have been investigated by the academic and industry communities. While many of these methods are practical and effective for botnet attack prevention, one of the important limits is the load factor on the servers that manage monitoring and control in addition to catering to client system requests. To address load factor difficulties, the focus of this study report is on the conditions of installing a four-layer security control system based on the notion of central pivot points. Inspired by the effective and systematic Markov Chains concept, this publication proposes a four-layer filtering model that shows if botnet detection and prevention methods for servers are required. The model's simulated experimental study demonstrates the potential scope of deploying the system. The study also highlights the future possibilities of model improvisation that can reduce any erroneous signal production that is judged necessary.

A real-time IoT-based botnet detection method using a novel two-step feature selection technique and the support vector machine classifier

A botnet, which is a collection of devices polluted by malicious software programs, is among the top security challenges in the Internet of Things (IoT) environments. Therefore, to deal with such an abnormality in these environments, different machine learning-based studies, which have resulted in outstanding findings, have been carried out and applied to predict the botnets. However, the existing techniques may still suffer from three main limitations. First, some of them are not suitable for real-time applications because they spend a lot of time to determine the normal/abnormal traffic. Second, the functionality of some of the approaches is not satisfactory because they ignore/do not utilize the efficient feature selection methods. Third, these studies have usually focused on generating a binary botnet prediction model without taking the attack types into consideration. To reduce the botnet prediction time and address the second and third restrictions, the present study suggested a two-step machine learning method designed based on our previously developed optimization algorithm (WCC) and the support vector machine classifier. The outcomes indicated that the proposed method outperforms the existing approaches since it can precisely classify the data streams into their related groups and make a trade-off between the total number of the selected features and the performance of the prediction model. The results also showed that IP addresses, source ports as well as destination hosts-related features, and the total number of the transferred data streams and their statistical measurements are possible key factors in identifying botnet traffics.

IoT botnet detection with feature reconstruction and interval optimization

The existing botnet detection methods have the problems of uneven sampling, poor feature selection, and weak generalization ability, resulting in low detection and classification results and poor adaptability to the internet of things (IoT) environment with limited computing and storage resources. This paper proposes an IoT botnet detection method using feature reconstruction and interval optimization to solve the above problems. Through the designed address triple and time window-based IP aggregation and feature reconstruction method (ATTW-IP-FR), the network traffic samples obtained from the IoT gateway are integrated, and the flow features are reconstructed to attain the reconstructed sample set. The proposed self-corrected hybrid weighted sampling algorithm balances the normal and botnet flow samples in the reconstructed sample set to get the resampling sample set. The introduced multiattribute decision-making and adjacency relation chain-based sequential forward selection algorithm is applied to eliminate the redundant features in the resampling sample set, and the optimal feature subset is obtained. The resampling sample set filtered by the optimal feature subset is detected and classified through the designed two-stage hybrid heterogeneous model optimized by the intermittent chaos and bald eagle search algorithm-based interval optimization algorithm. The experimental results show that the proposed method effectively detects the botnet in two real IoT scenarios. The detection accuracy is 99.17 % $ \% $ , the Matthews correlation coefficient is 98.35 % $ \% $ , the false positive rate is 0.25 % $ \% $ , and the false negative rate is 1.27 % $ \% $ , which are better than the existing methods. This method can effectively reduce sampling and feature selection time and space overhead and better adapt to the resource-constrained IoT environment.

A Protocol-Independent Botnet Detection Method Using Flow Similarity

The detection of botnets has always been a hot spot in the field of network security. However, there are still many challenges in botnet detection. Most of the current botnet detection approaches, such as machine learning and blacklists, cannot discover evolving botnet variants. These methods are usually only valid for specific botnet protocols which are not general. Even they may be difficult to deal with encrypted botnet traffic. In this paper, we design a protocol-independent botnet detection method for these challenges. Our detection method takes advantage of the group characteristic of the botnet, which is the inherent characteristics of the botnet. We use the sequence of packet length as the characteristic of a flow. Then, we calculate the similarity between these sequences to detect botnets. Our method has an excellent generality, which is not affected by encrypted traffic and the protocols of the botnet. Experiments on a challenging dataset ISCX show that the proposed method can effectively detect botnets with a high average detection rate and low false alarm, which significantly outperforms the state-of-the-art methods. Therefore, the proposed detection method is robust and has a wide range of adaptability in detecting botnets.

A novel and highly efficient botnet detection algorithm based on network traffic analysis of smart systems

In smart systems, attackers can use botnets to launch different cyber attack activities against the Internet of Things. The traditional methods of detecting botnets commonly used machine learning algorithms, and it is difficult to detect and control botnets in a network because of unbalanced traffic data. In this article, we present a novel and highly efficient botnet detection method based on an autoencoder neural network in cooperation with decision trees on a given network. The deep flow inspection method and statistical analysis are first applied as a feature selection technique to select relevant features, which are used to characterize the communication-related behavior between network nodes. Then, the autoencoder neural network for feature selection is used to improve the efficiency of model construction. Finally, Tomek-Recursion Borderline Synthetic Minority Oversampling Technique generates additional minority samples to achieve class balance, and an improved gradient boosting decision tree algorithm is used to train and establish an abnormal traffic detection model to improve the detection of unbalanced botnet data. The results of experiments on the ISCX-botnet traffic dataset show that the proposed method achieved better botnet detection performance with 99.10% recall, 99.20% accuracy, 99.1% F1 score, and 99.0% area under the curve.

DGA botnet detection method based on capsule network and k-means routing

DGA botnet detection method based on capsule network and k-means routing

Applications of Artificial Intelligence to Detect Android Botnets: A Survey

From the growing popularity of Android smart devices, and especially with the recent advances brought on by the COVID-19 pandemic on digital adoption and transformation, the importance of protecting these devices has grown, as they carry very sensitive data. Malicious attacks are targeting Android since it is open source and has the highest adoption rate among mobile platforms. Botnet attacks are one of the most often forgotten types of attacks. In addition, there is a lack of review papers that can clarify the state of knowledge and indicate research gaps in detecting android botnets. Therefore, in this paper, we conduct a literature review to highlight the contributions of several studies in the domain of Android Botnet detection. This study attempts to provide a comprehensive overview of the deployed AI apps for future academics interested in performing Android Botnet Detection studies. We focused on the applications of artificial intelligence and its two prominent subdomains, machine learning (ML) and deep learning (DL) techniques. The study presents available Android Botnet datasets suitable for detection using ML and DL algorithms. Moreover, this study provides an overview of the methodologies and tools utilized in APK analysis. The paper also serves as a comprehensive taxonomy of Android Botnet detection methods and highlights a number of challenges encountered while analyzing Android Botnet detection techniques. The research gaps indicated an absence of hybrid analysis research in the area, as well as a lack of an up-to-date dataset and a time-series dataset. The findings of this paper show valuable prospective directions for future research and development opportunities.

A Lightweight Hybrid Detection Method for Botnet

Botnet is a serious threat for the Internet and it has created great damage to the Internet. How to detect botnet has become an ongoing endeavor research. Series of methods have been discussed in recent research. However, one of the remaining challenges is that the high computational overhead. In this paper, a lightweight hybrid botnet detection method is proposed. Considering the features in the botnet data packets and the characteristic of employing DGA (Domain Generation Algorithm) domain names to connect to the botnet, two sensors are designed and deployed individually and parallelly. Signature detection is used on the gateway sensor to dig out known bot software and deep learning based techniques are used on the DNS (Domain Name Server) server sensor to find DGA domain names. With this method, the computational overhead would be shared by the two sensors and experiments are conducted and the results indicate that the method is effective in detecting botnet

Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research

Internet of Things (IoT) is promising technology that brings tremendous benefits if used optimally. At the same time, it has resulted in an increase in cybersecurity risks due to the lack of security for IoT devices. IoT botnets, for instance, have become a critical threat; however, systematic and comprehensive studies analyzing the importance of botnet detection methods are limited in the IoT environment. Thus, this study aimed to identify, assess and provide a thoroughly review of experimental works on the research relevant to the detection of IoT botnets. To accomplish this goal, a systematic literature review (SLR), an effective method, was applied for gathering and critically reviewing research papers. This work employed three research questions on the detection methods used to detect IoT botnets, the botnet phases and the different malicious activity scenarios. The authors analyzed the nominated research and the key methods related to them. The detection methods have been classified based on the techniques used, and the authors investigated the botnet phases during which detection is accomplished. This research procedure was used to create a source of foundational knowledge of IoT botnet detection methods. As a result of this study, the authors analyzed the current research gaps and suggest future research directions.

Multilayer Framework for Botnet Detection Using Machine Learning Algorithms

A botnet is a malware program that a hacker remotely controls called a botmaster. Botnet can perform massive cyber-attacks such as DDOS, SPAM, click-fraud, information, and identity stealing. The botnet also can avoid being detected by a security system. The traditional method of detecting botnets commonly used signature-based analysis unable to detect unseen botnets. The behavior-based analysis seems like a promising solution to the current trends of botnets that keep evolving. This paper proposes a multilayer framework for botnet detection using machine learning algorithms that consist of a filtering module and classification module to detect the botnet’s command and control server. We highlighted several criteria for our framework, such as it must be structure-independent, protocol-independent, and able to detect botnet in encapsulated technique. We used behavior-based analysis through flow-based features that analyzed the packet header by aggregating it to a 1-s time. This type of analysis enables detection if the packet is encapsulated, such as using a VPN tunnel. We also extend the experiment using different time intervals, but a 1-s time interval shows the most impressive results. The result shows that our botnet detection method can detect up to 92% of the f-score, and the lowest false-negative rate was 1.5%.

Intelligent system for IoT botnet detection using SVM and PSO optimization

Botnet attacks involving Internet-of-Things (IoT) devices have skyrocketed in recent years due to the proliferation of internet IoT devices that can be readily infiltrated. The botnet is a common threat, exploiting the absence of basic IoT security technologies and can perform several DDoS attacks. Existing IoT botnet detection methods still have issues, such as relying on labeled data, not being validated with newer botnets, and using very complex machine learning algorithms, making the development of new methods to detect compromised IoT devices urgent to reduce the negative implications of these IoT botnets. Due to the vast amount of normal data accessible, anomaly detection algorithms seem to promise for identifying botnet attacks on the Internet of Things (IoT). For anomaly detection, the One-Class Support vector machine is a strong method (ONE-SVM). Many aspects influence the classification outcomes of the ONE-SVM technique, like that of the subset of features utilized for training the ONE-SVM model, hyperparameters of the kernel. An evolutionary IoT botnet detection algorithm is described in this paper. Particle Swarm Optimization technique (PSO) is used to tune the hyperparameters of the ONE-SVM to detect IoT botnet assaults launched from hacked IoT devices. A new version of a real benchmark dataset is used to evaluate the proposed method's performance using traditional anomaly detection evaluation measures. This technique exceeds all existing algorithms in terms of false positive, true positive and rates, and G-mean for all IoT device categories, according to testing results. It also achieves the shortest detection time despite lowering the number of picked features by a significant amount.

Design and Implementation of Automated Steganography Image-Detection System for the KakaoTalk Instant Messenger

As the popularity of social network service (SNS) messengers (such as Telegram, WeChat or KakaoTalk) grows rapidly, cyberattackers and cybercriminals start targeting them, and from various media, we can see numerous cyber incidents that have occurred in the SNS messenger platforms. Especially, according to existing studies, a novel type of botnet, which is the so-called steganography-based botnet (stego-botnet), can be constructed and implemented in SNS chat messengers. In the stego-botnet, by using various steganography techniques, every botnet communication and control (C&C) messages are secretly embedded into multimedia files (such as image or video files) frequently shared in the SNS messenger. As a result, the stego-botnet can hide its malicious messages between a bot master and bots much better than existing botnets by avoiding traditional botnet-detection methods without steganography-detection functions. Meanwhile, existing studies have focused on devising and improving steganography-detection algorithms but no studies conducted automated steganography image-detection system although there are a large amount of SNS chatrooms on the Internet and thus may exist many potential steganography images on those chatrooms which need to be inspected for security. Consequently, in this paper, we propose an automated system that detects steganography image files by collecting and inspecting all image files shared in an SNS chatroom based on open image steganography tools. In addition, we implement our proposed system based on two open steganography tools (Stegano and Cryptosteganography) in the KakaoTalk SNS messenger and show our experimental results that validate our proposed automated detection system work successfully according to our design purposes.

Comparative Analysis of Network flow-based Botnet Detection Methods Using Supervised Machine Learning Algorithms

Comparative Analysis of Network flow-based Botnet Detection Methods Using Supervised Machine Learning Algorithms

Benchmark-Based Reference Model for Evaluating Botnet Detection Tools Driven by Traffic-Flow Analytics.

Botnets are some of the most recurrent cyber-threats, which take advantage of the wide heterogeneity of endpoint devices at the Edge of the emerging communication environments for enabling the malicious enforcement of fraud and other adversarial tactics, including malware, data leaks or denial of service. There have been significant research advances in the development of accurate botnet detection methods underpinned on supervised analysis but assessing the accuracy and performance of such detection methods requires a clear evaluation model in the pursuit of enforcing proper defensive strategies. In order to contribute to the mitigation of botnets, this paper introduces a novel evaluation scheme grounded on supervised machine learning algorithms that enable the detection and discrimination of different botnets families on real operational environments. The proposal relies on observing, understanding and inferring the behavior of each botnet family based on network indicators measured at flow-level. The assumed evaluation methodology contemplates six phases that allow building a detection model against botnet-related malware distributed through the network, for which five supervised classifiers were instantiated were instantiated for further comparisons—Decision Tree, Random Forest, Naive Bayes Gaussian, Support Vector Machine and K-Neighbors. The experimental validation was performed on two public datasets of real botnet traffic—CIC-AWS-2018 and ISOT HTTP Botnet. Bearing the heterogeneity of the datasets, optimizing the analysis with the Grid Search algorithm led to improve the classification results of the instantiated algorithms. An exhaustive evaluation was carried out demonstrating the adequateness of our proposal which prompted that Random Forest and Decision Tree models are the most suitable for detecting different botnet specimens among the chosen algorithms. They exhibited higher precision rates whilst analyzing a large number of samples with less processing time. The variety of testing scenarios were deeply assessed and reported to set baseline results for future benchmark analysis targeted on flow-based behavioral patterns.

BotDetector: An extreme learning machine‐based Internet of Things botnet detection model

AbstractThe development of artificial intelligence has brought new methods for botnet detection. For better performance, deep learning (DL) is more and more widely employed to botnet detecting. The existing DL‐based botnet detection methods require lots of computing resources and running time. While in the real Internet of Things (IoT) environment, real‐time and low computing consumption are much needed. Therefore, the DL‐based methods seem to be powerless in real‐time IoT scenarios. For these reasons, this article proposes a botnet detection model based on extreme learning machine, named BotDetector, which can directly obtain network stream files and quickly learn without data processing to extract botnet traffic characteristics. Experiments show that BotDetector has a good performance, which can identify botnets accurately with great reduction the time consumption and resource consumption. Furthermore, BotDetector has strong applicability in real IoT scenes.

Detecting botnet by using particle swarm optimization algorithm based on voting system

Botnets have recently been identified as serious Internet threats that are continually developing and expanding. Identifying botnets in the domain of network security is regarded as a new challenge and topic for research. There are several methods for detecting botnets in networks, and prior research has encountered problems, including a high error and inaccuracy in detection. In this paper, the botnet detection method by using a hybrid of particle swarm optimization (PSO) algorithm with a voting system (BD-PSO-V) was used to improve the challenges of previous studies. The PSO algorithm was employed to select outstanding and effective features in the detection of botnets. The voting system, including a deep neural network algorithm, support vector machine (SVM), and decision tree C4.5, were utilized to identify botnets and classify samples. The decision-making strategy of the voting system was based on maximum votes, and the most important innovation of this research was to combine the PSO feature selection algorithm with a voting system using deep learning to identify botnets. Two datasets, ISOT and Bot-IoT, were employed to further verify the BD-PSO-V system performance. BD-PSO-V simulation improved the accuracy by an average of ∼0.42% and 0.17% in the ISOT dataset and the Bot-IoT dataset, respectively, compared to the other methods investigated. In addition, the effect of six well-known adversarial attacks on both datasets was evaluated. Despite a slight drop in accuracy rate, BD-PSO-V results had a promising performance against a variety of attacks.