Visible to the public An efficient flow-based botnet detection using supervised machine learning

TitleAn efficient flow-based botnet detection using supervised machine learning
Publication TypeConference Paper
Year of Publication2014
AuthorsStevanovic, M., Pedersen, J.M.
Conference NameComputing, Networking and Communications (ICNC), 2014 International Conference on
Date PublishedFeb
KeywordsAccuracy, Bayes methods, Botnet, Botnet detection, botnet neutralization, computer network security, feature extraction, flow-based botnet detection, flow-based traffic analysis, invasive software, learning (artificial intelligence), machine learning, malicious botnet network traffic identification, nonmalicious applications, P2P botnets, packet flow, Peer-to-peer computing, Protocols, supervised machine learning, Support vector machines, telecommunication traffic, Traffic analysis, Traffic classification, Training, Vegetation

Botnet detection represents one of the most crucial prerequisites of successful botnet neutralization. This paper explores how accurate and timely detection can be achieved by using supervised machine learning as the tool of inferring about malicious botnet traffic. In order to do so, the paper introduces a novel flow-based detection system that relies on supervised machine learning for identifying botnet network traffic. For use in the system we consider eight highly regarded machine learning algorithms, indicating the best performing one. Furthermore, the paper evaluates how much traffic needs to be observed per flow in order to capture the patterns of malicious traffic. The proposed system has been tested through the series of experiments using traffic traces originating from two well-known P2P botnets and diverse non-malicious applications. The results of experiments indicate that the system is able to accurately and timely detect botnet traffic using purely flow-based traffic analysis and supervised machine learning. Additionally, the results show that in order to achieve accurate detection traffic flows need to be monitored for only a limited time period and number of packets per flow. This indicates a strong potential of using the proposed approach within a future on-line detection framework.

Citation Key6785439