Using Machine Learning to Detect Botnets in Network Traffic

Abstract

With the changing times, the faces of dangers have also changed. The way is still through disguise, but the medium is now digital. And out of all the dangers, the most dangerous threat is that of botnets because their botmaster not only takes control of millions of millions of systems in his/her hands, but also uses them for executing his terrible plans. Botnet-based attacks can be of different threat vectors such as spamming in case of web-account abuse attack or botnets causing DDoS attacks. Many techniques have been found to detect botnets such as detecting botnets from anomalies in network behavior, using NetFlow to recognize these anomalies or graphically understanding the network traffic, but the specialty about botnets is that they change their network traffic behavior every time they launch an attack. Therefore, this research is based on finding out the ability of popular machine learning classifiers to detect botnets so that servers and firewalls can use the best of these models to protect themselves from botnets. In this research, we have used decision tree, logistic regression, support vector machine, Gaussian Naive Bayes, and K-means clustering machine learning classifiers to train them using CTU-13 dataset and finally calculating their accuracy to detect botnets. And as a result, the ability of the decision tree to detect the changing behavior of botnets has been found to be more than that of the others.