Botnets are a prevalent and growing security threat that continue to impact organizations of all sizes worldwide. Their evolution and adaptation to evade traditional detection systems make them challenging to effectively defend against. Hence in this paper, we propose and investigate a deep learning-based approach to detect botnet traffic by leveraging raw bytes extracted from network flow data. The proposed approach utilizes bytes extracted from bi-directional flows which were used in training a convolutional neural network (CNN) for binary classification to identify botnet activity from benign traffic, and for multi-class classification to identify botnet families. We evaluate our method using the CTU-13 dataset where 71,066 flows consisting of five different families and 44,600 benign flows were extracted. In the experiments to investigate the performance of the CNN model for binary botnet identification, an accuracy of 99.99% was observed, which was higher compared to other machine learning classifiers. For the multi-class family identification, the macro-averaged F1 score was 0.8596, which improved to 0.8945 when Synthetic Minority Oversampling Technique (SMOTE) technique was applied to balance the training dataset by augmenting with synthetic botnet data.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Botnet Detection and Classification from Network Traffic Byte Streams Using Deep Learning

  • Rajesh Thomas,
  • Suleiman Y. Yerima,
  • Khaled Shalaan

摘要

Botnets are a prevalent and growing security threat that continue to impact organizations of all sizes worldwide. Their evolution and adaptation to evade traditional detection systems make them challenging to effectively defend against. Hence in this paper, we propose and investigate a deep learning-based approach to detect botnet traffic by leveraging raw bytes extracted from network flow data. The proposed approach utilizes bytes extracted from bi-directional flows which were used in training a convolutional neural network (CNN) for binary classification to identify botnet activity from benign traffic, and for multi-class classification to identify botnet families. We evaluate our method using the CTU-13 dataset where 71,066 flows consisting of five different families and 44,600 benign flows were extracted. In the experiments to investigate the performance of the CNN model for binary botnet identification, an accuracy of 99.99% was observed, which was higher compared to other machine learning classifiers. For the multi-class family identification, the macro-averaged F1 score was 0.8596, which improved to 0.8945 when Synthetic Minority Oversampling Technique (SMOTE) technique was applied to balance the training dataset by augmenting with synthetic botnet data.