Comparative Analysis of Network flow-based Botnet Detection Methods Using Supervised Machine Learning Algorithms
International Journal of Advanced Trends in Computer Science and Engineering · 2020
The botnet emerges as a top-listed threat to interconnected computer network systems.The increasing number of botnet attacks and rapidly changing evasion techniques demanding more generic long term and resilient botnet detection systems.The signature-based approaches naturally not able to cope up with this rapidly changing footprint.To automate the behavioral-based approaches, researchers start applying machine learning algorithms.These approaches either support online detection mode or offline detection mode.The detection proposals that apply supervised machine learning algorithms show promising results, where the C4.5 algorithm stands on top.In this paper, we present a comparative study of online botnet detection methods that apply C4.5 supervised machine learning algorithms.We have conducted a simulation study to evaluate the performance of two top listed detection methods from traditional IP networks and three of our botnet detection methods from Software Defined Networks.The evaluation is performed using CTU-13 publicly available real botnet dataset.The results show that the detection methods that are designed using a more diverse dataset perform better when a new variant of botnets introduced in the test dataset and has more detection coverage area.The results also conclude that an ensemble of multiple type-specific botnet classifiers not only help to detect botnet type but also perform better than one single generic classifier.