Multilayer framework for botnet detection using machine learning algorithms
A botnet is a malware program that a hacker remotely controls called a botmaster. Botnet can perform massive cyber-attacks such as DDOS, SPAM, click-fraud, information, and identity stealing. The botnet also can avoid being detected by a security system. The traditional method of detecting botnets c...
| Main Authors: | , , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Institute of Electrical and Electronics Engineers Inc.
2021
|
| Subjects: | |
| Online Access: | http://eprints.utm.my/94924/1/AliSelamat2021_MultilayerFrameworkforBotnet.pdf |
| _version_ | 1796865918671781888 |
|---|---|
| author | Ibrahim, W. N. H. Anuar, S. Selamat, A. Krejcar, O. Crespo, R. G. Viedma, E. H. Fujita, H. |
| author_facet | Ibrahim, W. N. H. Anuar, S. Selamat, A. Krejcar, O. Crespo, R. G. Viedma, E. H. Fujita, H. |
| author_sort | Ibrahim, W. N. H. |
| collection | ePrints |
| description | A botnet is a malware program that a hacker remotely controls called a botmaster. Botnet can perform massive cyber-attacks such as DDOS, SPAM, click-fraud, information, and identity stealing. The botnet also can avoid being detected by a security system. The traditional method of detecting botnets commonly used signature-based analysis unable to detect unseen botnets. The behavior-based analysis seems like a promising solution to the current trends of botnets that keep evolving. This paper proposes a multilayer framework for botnet detection using machine learning algorithms that consist of a filtering module and classification module to detect the botnet's command and control server. We highlighted several criteria for our framework, such as it must be structure-independent, protocol-independent, and able to detect botnet in encapsulated technique. We used behavior-based analysis through flow-based features that analyzed the packet header by aggregating it to a 1-s time. This type of analysis enables detection if the packet is encapsulated, such as using a VPN tunnel. We also extend the experiment using different time intervals, but a 1-s time interval shows the most impressive results. The result shows that our botnet detection method can detect up to 92% of the f-score, and the lowest false-negative rate was 1.5%. |
| first_indexed | 2024-03-05T21:04:24Z |
| format | Article |
| id | utm.eprints-94924 |
| institution | Universiti Teknologi Malaysia - ePrints |
| language | English |
| last_indexed | 2024-03-05T21:04:24Z |
| publishDate | 2021 |
| publisher | Institute of Electrical and Electronics Engineers Inc. |
| record_format | dspace |
| spelling | utm.eprints-949242022-04-29T21:55:07Z http://eprints.utm.my/94924/ Multilayer framework for botnet detection using machine learning algorithms Ibrahim, W. N. H. Anuar, S. Selamat, A. Krejcar, O. Crespo, R. G. Viedma, E. H. Fujita, H. TK Electrical engineering. Electronics Nuclear engineering A botnet is a malware program that a hacker remotely controls called a botmaster. Botnet can perform massive cyber-attacks such as DDOS, SPAM, click-fraud, information, and identity stealing. The botnet also can avoid being detected by a security system. The traditional method of detecting botnets commonly used signature-based analysis unable to detect unseen botnets. The behavior-based analysis seems like a promising solution to the current trends of botnets that keep evolving. This paper proposes a multilayer framework for botnet detection using machine learning algorithms that consist of a filtering module and classification module to detect the botnet's command and control server. We highlighted several criteria for our framework, such as it must be structure-independent, protocol-independent, and able to detect botnet in encapsulated technique. We used behavior-based analysis through flow-based features that analyzed the packet header by aggregating it to a 1-s time. This type of analysis enables detection if the packet is encapsulated, such as using a VPN tunnel. We also extend the experiment using different time intervals, but a 1-s time interval shows the most impressive results. The result shows that our botnet detection method can detect up to 92% of the f-score, and the lowest false-negative rate was 1.5%. Institute of Electrical and Electronics Engineers Inc. 2021 Article PeerReviewed application/pdf en http://eprints.utm.my/94924/1/AliSelamat2021_MultilayerFrameworkforBotnet.pdf Ibrahim, W. N. H. and Anuar, S. and Selamat, A. and Krejcar, O. and Crespo, R. G. and Viedma, E. H. and Fujita, H. (2021) Multilayer framework for botnet detection using machine learning algorithms. IEEE Access, 9 . ISSN 2169-3536 http://dx.doi.org/10.1109/ACCESS.2021.3060778 DOI: 10.1109/ACCESS.2021.3060778 |
| spellingShingle | TK Electrical engineering. Electronics Nuclear engineering Ibrahim, W. N. H. Anuar, S. Selamat, A. Krejcar, O. Crespo, R. G. Viedma, E. H. Fujita, H. Multilayer framework for botnet detection using machine learning algorithms |
| title | Multilayer framework for botnet detection using machine learning algorithms |
| title_full | Multilayer framework for botnet detection using machine learning algorithms |
| title_fullStr | Multilayer framework for botnet detection using machine learning algorithms |
| title_full_unstemmed | Multilayer framework for botnet detection using machine learning algorithms |
| title_short | Multilayer framework for botnet detection using machine learning algorithms |
| title_sort | multilayer framework for botnet detection using machine learning algorithms |
| topic | TK Electrical engineering. Electronics Nuclear engineering |
| url | http://eprints.utm.my/94924/1/AliSelamat2021_MultilayerFrameworkforBotnet.pdf |
| work_keys_str_mv | AT ibrahimwnh multilayerframeworkforbotnetdetectionusingmachinelearningalgorithms AT anuars multilayerframeworkforbotnetdetectionusingmachinelearningalgorithms AT selamata multilayerframeworkforbotnetdetectionusingmachinelearningalgorithms AT krejcaro multilayerframeworkforbotnetdetectionusingmachinelearningalgorithms AT cresporg multilayerframeworkforbotnetdetectionusingmachinelearningalgorithms AT viedmaeh multilayerframeworkforbotnetdetectionusingmachinelearningalgorithms AT fujitah multilayerframeworkforbotnetdetectionusingmachinelearningalgorithms |