Hybrid butterfly optimization algorithm-based support vector machine for botnet command-and-control channel detection
Kai Chen, Jietong Su, Lansheng Han, Shenghui Li, Pengyi Gao · 2022
Botnets are one of the most serious cyberspace security threats and are difficult to counter. We focus our detection on the weakest commands-and-control (C&C) phase to stop botnet attacks. The current C&C channel detection for multiple architectures suffers from low accuracy. To overcome these limitations, this study proposes a hybrid butterfly optimization algorithm (HBOA) combining support vector machine (SVM) hyperparameter optimization and feature selection (FS), called HBOA-SVM-FS, as a new botnet C&C channel detection framework. We identify the problem of inappropriate distribution of random multipliers in the butterfly optimization algorithm (BOA), which cause poor population convergence. HBOA replaces the original random multiplier with Gaussian mutation, and combines evolutionary state estimation and opposition-based learning (OBL) to mix continuous and binary domains for better search balance and convergence. The C&C imbalance problem is solved by the NearMiss-3 under-sampling technique. Then, the performance of the proposed framework is further validated using the CTU-13 dataset with the C&C architecture and protocol diversity. Experimental results show that the proposed method is superior to other methods in the classification accuracy, F-measure, and other indicators.