The Impact of Different Botnet Flow Feature Subsets on Prediction Accuracy Using Supervised and Unsupervised Learning Methods
Sean T. Miller, Curtis Busby-Earle · Journal of Internet Technology and Secured Transaction · 2016
Over the past ten to fifteen years botnets have gained the attention of researchers worldwide.A great deal of effort has been given to developing systems that would efficiently and effectively detect the presence of a botnet.This unique problem saw researchers applying machine learning (ML) to solve this problem.In this paper, a brief overview of the varied machine learning methods (ML) and their utility in relation to botnet detection is provided.The main aim of this paper is to clearly define the role different ML methods play in Botnet detection.We also examine different flow level feature subsets and the resulting impact on detection accuracy given the machine learning method used.A clear understanding of these various roles are critical for developing effective and efficient real-time online-detection approaches and ultimately, more robust models.In conclusion, it was found that, the features selected must compliment the machine learning method chosen. Related WorkSeveral authors have written reviews of botnetdetection approaches as well as detection techniques.Maryam Feily [2] conducted a survey of botnets and bot detection, explaining the way in which bots operate; examining dif-ferent botnet-detection approaches placing botnets in one of three classes, namely anomaly-based, DNS based or Mining based detection.The paper also surveyed botnets and botnet detection, its aim was to explain the botnet phenomena and explore different botnet detection tech-niques.The paper classified botnet detection into four classes, namely: anomalybased, signature-based, DNS-based, and mining-based.Along with the summarization of each class, detection techniques were compared.Thomas Hyslip et al [3] surveyed botnet detection techniques based on their command and control infrastructure.With a focus on bot detection technique, this review examined various detection techniques and their impact on different botnet architectures.Michael Bailey et al surveyed bot technology and defenses [4].This survey scrutinized different detection methods in light of the data source which provide the