Optimal Machine Learning Models for Kitsune to Detect Mirai Botnet Malware Attack
Syed Sajjad Hussain Rizvi Abdullah Alabdulatif · Journal of Hunan University · 2021
The network intrusion detection system (NIDS) is the key player to detect and mitigate Botnet Malware attacks. A plug-and-play NIDS, Kitsune, was proposed in the literature in 2018 as one of the best candidates. Kitsune's core algorithm is KitNET based on the ensemble of artificial neural networks called 'autoencoder' to classify legitimate and suspicious network traffic. Moreover, the Kitsune Network Attack dataset was donated to the UCI machine learning repository in October 2019. The study of Kitsune is found to be deficient in discussing the performance of other machine learning algorithms for Mirai Botnet malware attack detection besides artificial neural networks. Moreover, the study reported the performance as a true positive rate (TPR) and false-negative rate (FNR) only. In this paper, we propose that the selection of the model should be a function of TPR, FNR, training accuracy, test accuracy, misclassification cost, prediction speed, and train time. This paper presents a comprehensive investigation for selecting optimal machine learning model(s) for Kitsune. In this investigation, a large set of machine learning algorithms have opted. Our study reveals that the variants of tree algorithms such as Simple Tree, Medium Tree, Coarse Tree, RUSBoosted, and Bagged Tree have reported similar effectiveness but with slight variation inefficiency. Finally, Coarse Tree has won the competition and best-suited algorithm for Mirai botnet malware attack detection. Keywords: cybersecurity, malware, botnet attack, Kitsune, network intrusion detection.