Multilayer framework for botnet detection using machine learning algorithms

A botnet is a malware program that a hacker remotely controls called a botmaster. Botnet can perform massive cyber-attacks such as DDOS, SPAM, click-fraud, information, and identity stealing. The botnet also can avoid being detected by a security system. The traditional method of detecting botnets c...

Full description

Saved in:
Bibliographic Details
Main Authors: Ibrahim, W. N. H., Anuar, S., Selamat, A., Krejcar, O., Crespo, R. G., Viedma, E. H., Fujita, H.
Format: Article
Language:English
Published: Institute of Electrical and Electronics Engineers Inc. 2021
Subjects:
Online Access:http://eprints.utm.my/id/eprint/94924/1/AliSelamat2021_MultilayerFrameworkforBotnet.pdf
http://eprints.utm.my/id/eprint/94924/
http://dx.doi.org/10.1109/ACCESS.2021.3060778
Tags: Add Tag
No Tags, Be the first to tag this record!
Institution: Universiti Teknologi Malaysia
Language: English
id my.utm.94924
record_format eprints
spelling my.utm.949242022-04-29T21:55:07Z http://eprints.utm.my/id/eprint/94924/ Multilayer framework for botnet detection using machine learning algorithms Ibrahim, W. N. H. Anuar, S. Selamat, A. Krejcar, O. Crespo, R. G. Viedma, E. H. Fujita, H. TK Electrical engineering. Electronics Nuclear engineering A botnet is a malware program that a hacker remotely controls called a botmaster. Botnet can perform massive cyber-attacks such as DDOS, SPAM, click-fraud, information, and identity stealing. The botnet also can avoid being detected by a security system. The traditional method of detecting botnets commonly used signature-based analysis unable to detect unseen botnets. The behavior-based analysis seems like a promising solution to the current trends of botnets that keep evolving. This paper proposes a multilayer framework for botnet detection using machine learning algorithms that consist of a filtering module and classification module to detect the botnet's command and control server. We highlighted several criteria for our framework, such as it must be structure-independent, protocol-independent, and able to detect botnet in encapsulated technique. We used behavior-based analysis through flow-based features that analyzed the packet header by aggregating it to a 1-s time. This type of analysis enables detection if the packet is encapsulated, such as using a VPN tunnel. We also extend the experiment using different time intervals, but a 1-s time interval shows the most impressive results. The result shows that our botnet detection method can detect up to 92% of the f-score, and the lowest false-negative rate was 1.5%. Institute of Electrical and Electronics Engineers Inc. 2021 Article PeerReviewed application/pdf en http://eprints.utm.my/id/eprint/94924/1/AliSelamat2021_MultilayerFrameworkforBotnet.pdf Ibrahim, W. N. H. and Anuar, S. and Selamat, A. and Krejcar, O. and Crespo, R. G. and Viedma, E. H. and Fujita, H. (2021) Multilayer framework for botnet detection using machine learning algorithms. IEEE Access, 9 . ISSN 2169-3536 http://dx.doi.org/10.1109/ACCESS.2021.3060778 DOI: 10.1109/ACCESS.2021.3060778
institution Universiti Teknologi Malaysia
building UTM Library
collection Institutional Repository
continent Asia
country Malaysia
content_provider Universiti Teknologi Malaysia
content_source UTM Institutional Repository
url_provider http://eprints.utm.my/
language English
topic TK Electrical engineering. Electronics Nuclear engineering
spellingShingle TK Electrical engineering. Electronics Nuclear engineering
Ibrahim, W. N. H.
Anuar, S.
Selamat, A.
Krejcar, O.
Crespo, R. G.
Viedma, E. H.
Fujita, H.
Multilayer framework for botnet detection using machine learning algorithms
description A botnet is a malware program that a hacker remotely controls called a botmaster. Botnet can perform massive cyber-attacks such as DDOS, SPAM, click-fraud, information, and identity stealing. The botnet also can avoid being detected by a security system. The traditional method of detecting botnets commonly used signature-based analysis unable to detect unseen botnets. The behavior-based analysis seems like a promising solution to the current trends of botnets that keep evolving. This paper proposes a multilayer framework for botnet detection using machine learning algorithms that consist of a filtering module and classification module to detect the botnet's command and control server. We highlighted several criteria for our framework, such as it must be structure-independent, protocol-independent, and able to detect botnet in encapsulated technique. We used behavior-based analysis through flow-based features that analyzed the packet header by aggregating it to a 1-s time. This type of analysis enables detection if the packet is encapsulated, such as using a VPN tunnel. We also extend the experiment using different time intervals, but a 1-s time interval shows the most impressive results. The result shows that our botnet detection method can detect up to 92% of the f-score, and the lowest false-negative rate was 1.5%.
format Article
author Ibrahim, W. N. H.
Anuar, S.
Selamat, A.
Krejcar, O.
Crespo, R. G.
Viedma, E. H.
Fujita, H.
author_facet Ibrahim, W. N. H.
Anuar, S.
Selamat, A.
Krejcar, O.
Crespo, R. G.
Viedma, E. H.
Fujita, H.
author_sort Ibrahim, W. N. H.
title Multilayer framework for botnet detection using machine learning algorithms
title_short Multilayer framework for botnet detection using machine learning algorithms
title_full Multilayer framework for botnet detection using machine learning algorithms
title_fullStr Multilayer framework for botnet detection using machine learning algorithms
title_full_unstemmed Multilayer framework for botnet detection using machine learning algorithms
title_sort multilayer framework for botnet detection using machine learning algorithms
publisher Institute of Electrical and Electronics Engineers Inc.
publishDate 2021
url http://eprints.utm.my/id/eprint/94924/1/AliSelamat2021_MultilayerFrameworkforBotnet.pdf
http://eprints.utm.my/id/eprint/94924/
http://dx.doi.org/10.1109/ACCESS.2021.3060778
_version_ 1732945410707685376