Visible to the public Effective Botnet Detection Through Neural Networks on Convolutional Features

TitleEffective Botnet Detection Through Neural Networks on Convolutional Features
Publication TypeConference Paper
Year of Publication2018
AuthorsChen, S., Chen, Y., Tzeng, W.
Conference Name2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)
ISBN Number 978-1-5386-4388-4
KeywordsBotnet, Botnet detection, botnet detection system, botnets, compositionality, Computer crime, computer network security, convolution, convolutional features, convolutional neural networks, cybercrimes, DDoS Attacks, feature extraction, feed-forward artificial neural network, feedforward neural nets, Internet, invasive software, IP networks, learning (artificial intelligence), machine learning, Metrics, Network traffic classification, Neural networks, P2P botnet datasets, Payloads, Peer-to-peer computing, pubcrawl, resilience, Resiliency, Servers, telecommunication traffic, Training

Botnet is one of the major threats on the Internet for committing cybercrimes, such as DDoS attacks, stealing sensitive information, spreading spams, etc. It is a challenging issue to detect modern botnets that are continuously improving for evading detection. In this paper, we propose a machine learning based botnet detection system that is shown to be effective in identifying P2P botnets. Our approach extracts convolutional version of effective flow-based features, and trains a classification model by using a feed-forward artificial neural network. The experimental results show that the accuracy of detection using the convolutional features is better than the ones using the traditional features. It can achieve 94.7% of detection accuracy and 2.2% of false positive rate on the known P2P botnet datasets. Furthermore, our system provides an additional confidence testing for enhancing performance of botnet detection. It further classifies the network traffic of insufficient confidence in the neural network. The experiment shows that this stage can increase the detection accuracy up to 98.6% and decrease the false positive rate up to 0.5%.

Citation Keychen_effective_2018